no message

Example/Pods/libsodium-ios/LICENSE.md

@@ -0,0 +1,44 @@
+
+
+License
+-------
+
+Copyright (c) 2013
+Moritz C. Türck
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+Original License
+----------------
+
+Copyright (c) 2013
+Frank Denis <j at pureftpd dot org>
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
+
+
+
+

Example/Pods/libsodium-ios/README.md

@@ -0,0 +1,39 @@
+libsodium-ios
+=============
+
+
+NaCl
+-------
+
+The NaCl-Library is the easiest way to use safe crypto for your apps. It provides for network communication, encryption, decryption, signatures and more. Look for yourself: http://nacl.cr.yp.to
+
+
+Sodium
+------
+
+From their readme:
+
+> Sodium is a portable, cross-compilable, installable, packageable fork of NaCl, with a compatible API.
+  
+https://github.com/jedisct1/libsodium
+
+
+
+libsodium-ios
+-------------
+
+This repo provides two things:
+* a prebuild static library for iOS of the sodium library and the preprocessed headerfiles for targeting a darwin/arm7 system
+* the preprocessed headerfiles (for darwin/arm7) and sourcecode to use it directly in XCode
+
+It is used by the CocoaPod "libsodium-ios" and gives easy access to the functionalities of NaCl for iOS developers.
+
+I hope this enables more and more developers to use easy and secure crypto in their apps.
+
+
+Feedback is most welcome!
+
+
+Thanks to Frank, all the sodium contributors and the NaCl team to make this possible.
+
+

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/crypto_auth.c

@@ -0,0 +1,34 @@
+
+#include "crypto_auth.h"
+
+size_t
+crypto_auth_bytes(void)
+{
+    return crypto_auth_BYTES;
+}
+
+size_t
+crypto_auth_keybytes(void)
+{
+    return crypto_auth_KEYBYTES;
+}
+
+const char *
+crypto_auth_primitive(void)
+{
+    return crypto_auth_PRIMITIVE;
+}
+
+int
+crypto_auth(unsigned char *out, const unsigned char *in,
+            unsigned long long inlen, const unsigned char *k)
+{
+    return crypto_auth_hmacsha512256(out, in, inlen, k);
+}
+
+int
+crypto_auth_verify(const unsigned char *h, const unsigned char *in,
+                   unsigned long long inlen,const unsigned char *k)
+{
+    return crypto_auth_hmacsha512256_verify(h, in, inlen, k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha256/auth_hmacsha256_api.c

@@ -0,0 +1,16 @@
+#include "crypto_auth_hmacsha256.h"
+
+size_t
+crypto_auth_hmacsha256_bytes(void) {
+    return crypto_auth_hmacsha256_BYTES;
+}
+
+size_t
+crypto_auth_hmacsha256_keybytes(void) {
+    return crypto_auth_hmacsha256_KEYBYTES;
+}
+
+const char *
+crypto_auth_hmacsha256_primitive(void) {
+    return "hmacsha256";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha256/ref/api.h

@@ -0,0 +1,10 @@
+
+#include "crypto_auth_hmacsha256.h"
+
+#define crypto_auth crypto_auth_hmacsha256
+#define crypto_auth_verify crypto_auth_hmacsha256_verify
+#define crypto_auth_BYTES crypto_auth_hmacsha256_BYTES
+#define crypto_auth_KEYBYTES crypto_auth_hmacsha256_KEYBYTES
+#define crypto_auth_PRIMITIVE "hmacsha256"
+#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha256_IMPLEMENTATION
+#define crypto_auth_VERSION crypto_auth_hmacsha256_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha256/ref/hmac_hmacsha256.c

@@ -0,0 +1,83 @@
+/*
+ * 20080913
+ * D. J. Bernstein
+ * Public domain.
+ * */
+
+#include "api.h"
+#include "crypto_hashblocks_sha256.h"
+
+#define blocks crypto_hashblocks_sha256
+
+typedef unsigned int uint32;
+
+static const unsigned char iv[32] = {
+  0x6a,0x09,0xe6,0x67,
+  0xbb,0x67,0xae,0x85,
+  0x3c,0x6e,0xf3,0x72,
+  0xa5,0x4f,0xf5,0x3a,
+  0x51,0x0e,0x52,0x7f,
+  0x9b,0x05,0x68,0x8c,
+  0x1f,0x83,0xd9,0xab,
+  0x5b,0xe0,0xcd,0x19,
+} ;
+
+int crypto_auth(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char h[32];
+  unsigned char padded[128];
+  unsigned long long i;
+  unsigned long long bits = 512 + (inlen << 3);
+
+  for (i = 0;i < 32;++i) h[i] = iv[i];
+
+  for (i = 0;i < 32;++i) padded[i] = k[i] ^ 0x36;
+  for (i = 32;i < 64;++i) padded[i] = 0x36;
+
+  blocks(h,padded,64);
+  blocks(h,in,inlen);
+  in += inlen;
+  inlen &= 63;
+  in -= inlen;
+
+  for (i = 0;i < inlen;++i) padded[i] = in[i];
+  padded[inlen] = 0x80;
+
+  if (inlen < 56) {
+    for (i = inlen + 1;i < 56;++i) padded[i] = 0;
+    padded[56] = bits >> 56;
+    padded[57] = bits >> 48;
+    padded[58] = bits >> 40;
+    padded[59] = bits >> 32;
+    padded[60] = bits >> 24;
+    padded[61] = bits >> 16;
+    padded[62] = bits >> 8;
+    padded[63] = bits;
+    blocks(h,padded,64);
+  } else {
+    for (i = inlen + 1;i < 120;++i) padded[i] = 0;
+    padded[120] = bits >> 56;
+    padded[121] = bits >> 48;
+    padded[122] = bits >> 40;
+    padded[123] = bits >> 32;
+    padded[124] = bits >> 24;
+    padded[125] = bits >> 16;
+    padded[126] = bits >> 8;
+    padded[127] = bits;
+    blocks(h,padded,128);
+  }
+
+  for (i = 0;i < 32;++i) padded[i] = k[i] ^ 0x5c;
+  for (i = 32;i < 64;++i) padded[i] = 0x5c;
+  for (i = 0;i < 32;++i) padded[64 + i] = h[i];
+
+  for (i = 0;i < 32;++i) out[i] = iv[i];
+
+  for (i = 32;i < 64;++i) padded[64 + i] = 0;
+  padded[64 + 32] = 0x80;
+  padded[64 + 62] = 3;
+
+  blocks(out,padded,128);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha256/ref/verify_hmacsha256.c

@@ -0,0 +1,9 @@
+#include "api.h"
+#include "crypto_verify_32.h"
+
+int crypto_auth_verify(const unsigned char *h,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char correct[32];
+  crypto_auth(correct,in,inlen,k);
+  return crypto_verify_32(h,correct);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha512256/auth_hmacsha512256_api.c

@@ -0,0 +1,16 @@
+#include "crypto_auth_hmacsha512256.h"
+
+size_t
+crypto_auth_hmacsha512256_bytes(void) {
+    return crypto_auth_hmacsha512256_BYTES;
+}
+
+size_t
+crypto_auth_hmacsha512256_keybytes(void) {
+    return crypto_auth_hmacsha512256_KEYBYTES;
+}
+
+const char *
+crypto_auth_hmacsha512256_primitive(void) {
+    return "hmacsha512256";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha512256/ref/api.h

@@ -0,0 +1,10 @@
+
+#include "crypto_auth_hmacsha512256.h"
+
+#define crypto_auth crypto_auth_hmacsha512256
+#define crypto_auth_verify crypto_auth_hmacsha512256_verify
+#define crypto_auth_BYTES crypto_auth_hmacsha512256_BYTES
+#define crypto_auth_KEYBYTES crypto_auth_hmacsha512256_KEYBYTES
+#define crypto_auth_PRIMITIVE "hmacsha512256"
+#define crypto_auth_IMPLEMENTATION crypto_auth_hmacsha512256_IMPLEMENTATION
+#define crypto_auth_VERSION crypto_auth_hmacsha512256_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha512256/ref/hmac_hmacsha512256.c

@@ -0,0 +1,86 @@
+/*
+ * 20080913
+ * D. J. Bernstein
+ * Public domain.
+ * */
+
+#include "api.h"
+#include "crypto_hashblocks_sha512.h"
+
+#define blocks crypto_hashblocks_sha512
+
+typedef unsigned long long uint64;
+
+static const unsigned char iv[64] = {
+  0x6a,0x09,0xe6,0x67,0xf3,0xbc,0xc9,0x08,
+  0xbb,0x67,0xae,0x85,0x84,0xca,0xa7,0x3b,
+  0x3c,0x6e,0xf3,0x72,0xfe,0x94,0xf8,0x2b,
+  0xa5,0x4f,0xf5,0x3a,0x5f,0x1d,0x36,0xf1,
+  0x51,0x0e,0x52,0x7f,0xad,0xe6,0x82,0xd1,
+  0x9b,0x05,0x68,0x8c,0x2b,0x3e,0x6c,0x1f,
+  0x1f,0x83,0xd9,0xab,0xfb,0x41,0xbd,0x6b,
+  0x5b,0xe0,0xcd,0x19,0x13,0x7e,0x21,0x79
+} ;
+
+int crypto_auth(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char h[64];
+  unsigned char padded[256];
+  unsigned long long i;
+  unsigned long long bytes = 128 + inlen;
+
+  for (i = 0;i < 64;++i) h[i] = iv[i];
+
+  for (i = 0;i < 32;++i) padded[i] = k[i] ^ 0x36;
+  for (i = 32;i < 128;++i) padded[i] = 0x36;
+
+  blocks(h,padded,128);
+  blocks(h,in,inlen);
+  in += inlen;
+  inlen &= 127;
+  in -= inlen;
+
+  for (i = 0;i < inlen;++i) padded[i] = in[i];
+  padded[inlen] = 0x80;
+
+  if (inlen < 112) {
+    for (i = inlen + 1;i < 119;++i) padded[i] = 0;
+    padded[119] = bytes >> 61;
+    padded[120] = bytes >> 53;
+    padded[121] = bytes >> 45;
+    padded[122] = bytes >> 37;
+    padded[123] = bytes >> 29;
+    padded[124] = bytes >> 21;
+    padded[125] = bytes >> 13;
+    padded[126] = bytes >> 5;
+    padded[127] = bytes << 3;
+    blocks(h,padded,128);
+  } else {
+    for (i = inlen + 1;i < 247;++i) padded[i] = 0;
+    padded[247] = bytes >> 61;
+    padded[248] = bytes >> 53;
+    padded[249] = bytes >> 45;
+    padded[250] = bytes >> 37;
+    padded[251] = bytes >> 29;
+    padded[252] = bytes >> 21;
+    padded[253] = bytes >> 13;
+    padded[254] = bytes >> 5;
+    padded[255] = bytes << 3;
+    blocks(h,padded,256);
+  }
+
+  for (i = 0;i < 32;++i) padded[i] = k[i] ^ 0x5c;
+  for (i = 32;i < 128;++i) padded[i] = 0x5c;
+
+  for (i = 0;i < 64;++i) padded[128 + i] = h[i];
+  for (i = 0;i < 64;++i) h[i] = iv[i];
+
+  for (i = 64;i < 128;++i) padded[128 + i] = 0;
+  padded[128 + 64] = 0x80;
+  padded[128 + 126] = 6;
+
+  blocks(h,padded,256);
+  for (i = 0;i < 32;++i) out[i] = h[i];
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_auth/hmacsha512256/ref/verify_hmacsha512256.c

@@ -0,0 +1,9 @@
+#include "api.h"
+#include "crypto_verify_32.h"
+
+int crypto_auth_verify(const unsigned char *h,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char correct[32];
+  crypto_auth(correct,in,inlen,k);
+  return crypto_verify_32(h,correct);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/crypto_box.c

@@ -0,0 +1,95 @@
+
+#include "crypto_box.h"
+
+size_t
+crypto_box_publickeybytes(void)
+{
+    return crypto_box_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_box_secretkeybytes(void)
+{
+    return crypto_box_SECRETKEYBYTES;
+}
+
+size_t
+crypto_box_beforenmbytes(void)
+{
+    return crypto_box_BEFORENMBYTES;
+}
+
+size_t
+crypto_box_noncebytes(void)
+{
+    return crypto_box_NONCEBYTES;
+}
+
+size_t
+crypto_box_zerobytes(void)
+{
+    return crypto_box_ZEROBYTES;
+}
+
+size_t
+crypto_box_boxzerobytes(void)
+{
+    return crypto_box_BOXZEROBYTES;
+}
+
+size_t
+crypto_box_macbytes(void)
+{
+    return crypto_box_MACBYTES;
+}
+
+const char *
+crypto_box_primitive(void)
+{
+    return crypto_box_PRIMITIVE;
+}
+
+int
+crypto_box_keypair(unsigned char *pk, unsigned char *sk)
+{
+    return crypto_box_curve25519xsalsa20poly1305_keypair(pk, sk);
+}
+
+int
+crypto_box_beforenm(unsigned char *k, const unsigned char *pk,
+                    const unsigned char *sk)
+{
+    return crypto_box_curve25519xsalsa20poly1305_beforenm(k, pk, sk);
+}
+
+int
+crypto_box_afternm(unsigned char *c, const unsigned char *m,
+                   unsigned long long mlen, const unsigned char *n,
+                   const unsigned char *k)
+{
+    return crypto_box_curve25519xsalsa20poly1305_afternm(c, m, mlen, n, k);
+}
+
+int
+crypto_box_open_afternm(unsigned char *m, const unsigned char *c,
+                        unsigned long long clen, const unsigned char *n,
+                        const unsigned char *k)
+{
+    return crypto_box_curve25519xsalsa20poly1305_open_afternm(m, c, clen, n, k);
+}
+
+int
+crypto_box(unsigned char *c, const unsigned char *m,
+           unsigned long long mlen, const unsigned char *n,
+           const unsigned char *pk, const unsigned char *sk)
+{
+    return crypto_box_curve25519xsalsa20poly1305(c, m, mlen, n, pk, sk);
+}
+
+int
+crypto_box_open(unsigned char *m, const unsigned char *c,
+                unsigned long long clen, const unsigned char *n,
+                const unsigned char *pk, const unsigned char *sk)
+{
+    return crypto_box_curve25519xsalsa20poly1305_open(m, c, clen, n, pk, sk);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/box_curve25519xsalsa20poly1305_api.c

@@ -0,0 +1,41 @@
+#include "crypto_box_curve25519xsalsa20poly1305.h"
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_publickeybytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_secretkeybytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_beforenmbytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_noncebytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_NONCEBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_zerobytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_ZEROBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_boxzerobytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES;
+}
+
+size_t
+crypto_box_curve25519xsalsa20poly1305_macbytes(void) {
+    return crypto_box_curve25519xsalsa20poly1305_MACBYTES;
+}
+
+const char *
+crypto_box_curve25519xsalsa20poly1305_primitive(void) {
+    return "curve25519xsalsa20poly1305";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/after_curve25519xsalsa20poly1305.c

@@ -0,0 +1,22 @@
+#include "api.h"
+#include "crypto_secretbox_xsalsa20poly1305.h"
+
+int crypto_box_afternm(
+  unsigned char *c,
+  const unsigned char *m,unsigned long long mlen,
+  const unsigned char *n,
+  const unsigned char *k
+)
+{
+  return crypto_secretbox_xsalsa20poly1305(c,m,mlen,n,k);
+}
+
+int crypto_box_open_afternm(
+  unsigned char *m,
+  const unsigned char *c,unsigned long long clen,
+  const unsigned char *n,
+  const unsigned char *k
+)
+{
+  return crypto_secretbox_xsalsa20poly1305_open(m,c,clen,n,k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/api.h

@@ -0,0 +1,19 @@
+
+#include "crypto_box_curve25519xsalsa20poly1305.h"
+
+#define crypto_box crypto_box_curve25519xsalsa20poly1305
+#define crypto_box_open crypto_box_curve25519xsalsa20poly1305_open
+#define crypto_box_keypair crypto_box_curve25519xsalsa20poly1305_keypair
+#define crypto_box_beforenm crypto_box_curve25519xsalsa20poly1305_beforenm
+#define crypto_box_afternm crypto_box_curve25519xsalsa20poly1305_afternm
+#define crypto_box_open_afternm crypto_box_curve25519xsalsa20poly1305_open_afternm
+#define crypto_box_PUBLICKEYBYTES crypto_box_curve25519xsalsa20poly1305_PUBLICKEYBYTES
+#define crypto_box_SECRETKEYBYTES crypto_box_curve25519xsalsa20poly1305_SECRETKEYBYTES
+#define crypto_box_BEFORENMBYTES crypto_box_curve25519xsalsa20poly1305_BEFORENMBYTES
+#define crypto_box_NONCEBYTES crypto_box_curve25519xsalsa20poly1305_NONCEBYTES
+#define crypto_box_ZEROBYTES crypto_box_curve25519xsalsa20poly1305_ZEROBYTES
+#define crypto_box_BOXZEROBYTES crypto_box_curve25519xsalsa20poly1305_BOXZEROBYTES
+#define crypto_box_MACBYTES (crypto_box_ZEROBYTES - crypto_box_BOXZEROBYTES)
+#define crypto_box_PRIMITIVE "curve25519xsalsa20poly1305"
+#define crypto_box_IMPLEMENTATION crypto_box_curve25519xsalsa20poly1305_IMPLEMENTATION
+#define crypto_box_VERSION crypto_box_curve25519xsalsa20poly1305_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/before_curve25519xsalsa20poly1305.c

@@ -0,0 +1,19 @@
+#include "api.h"
+#include "crypto_core_hsalsa20.h"
+#include "crypto_scalarmult_curve25519.h"
+
+static const unsigned char sigma[16] = {
+    'e', 'x', 'p', 'a', 'n', 'd', ' ', '3', '2', '-', 'b', 'y', 't', 'e', ' ', 'k'
+};
+static const unsigned char n[16] = {0};
+
+int crypto_box_beforenm(
+  unsigned char *k,
+  const unsigned char *pk,
+  const unsigned char *sk
+)
+{
+  unsigned char s[32];
+  crypto_scalarmult_curve25519(s,sk,pk);
+  return crypto_core_hsalsa20(k,n,s,sigma);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/box_curve25519xsalsa20poly1305.c

@@ -0,0 +1,27 @@
+#include "api.h"
+
+int crypto_box(
+  unsigned char *c,
+  const unsigned char *m,unsigned long long mlen,
+  const unsigned char *n,
+  const unsigned char *pk,
+  const unsigned char *sk
+)
+{
+  unsigned char k[crypto_box_BEFORENMBYTES];
+  crypto_box_beforenm(k,pk,sk);
+  return crypto_box_afternm(c,m,mlen,n,k);
+}
+
+int crypto_box_open(
+  unsigned char *m,
+  const unsigned char *c,unsigned long long clen,
+  const unsigned char *n,
+  const unsigned char *pk,
+  const unsigned char *sk
+)
+{
+  unsigned char k[crypto_box_BEFORENMBYTES];
+  crypto_box_beforenm(k,pk,sk);
+  return crypto_box_open_afternm(m,c,clen,n,k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_box/curve25519xsalsa20poly1305/ref/keypair_curve25519xsalsa20poly1305.c

@@ -0,0 +1,12 @@
+#include "crypto_scalarmult_curve25519.h"
+#include "api.h"
+#include "randombytes.h"
+
+int crypto_box_keypair(
+  unsigned char *pk,
+  unsigned char *sk
+)
+{
+  randombytes(sk,32);
+  return crypto_scalarmult_curve25519_base(pk,sk);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/hsalsa20/core_hsalsa20_api.c

@@ -0,0 +1,26 @@
+#include "crypto_core_hsalsa20.h"
+
+size_t
+crypto_core_hsalsa20_outputbytes(void) {
+    return crypto_core_hsalsa20_OUTPUTBYTES;
+}
+
+size_t
+crypto_core_hsalsa20_inputbytes(void) {
+    return crypto_core_hsalsa20_INPUTBYTES;
+}
+
+size_t
+crypto_core_hsalsa20_keybytes(void) {
+    return crypto_core_hsalsa20_KEYBYTES;
+}
+
+size_t
+crypto_core_hsalsa20_constbytes(void) {
+    return crypto_core_hsalsa20_CONSTBYTES;
+}
+
+const char *
+crypto_core_hsalsa20_primitive(void) {
+    return "hsalsa20";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/hsalsa20/ref2/api.h

@@ -0,0 +1,11 @@
+
+#include "crypto_core_hsalsa20.h"
+
+#define crypto_core crypto_core_hsalsa20
+#define crypto_core_OUTPUTBYTES crypto_core_hsalsa20_OUTPUTBYTES
+#define crypto_core_INPUTBYTES crypto_core_hsalsa20_INPUTBYTES
+#define crypto_core_KEYBYTES crypto_core_hsalsa20_KEYBYTES
+#define crypto_core_CONSTBYTES crypto_core_hsalsa20_CONSTBYTES
+#define crypto_core_PRIMITIVE "hsalsa20"
+#define crypto_core_IMPLEMENTATION crypto_core_hsalsa20_IMPLEMENTATION
+#define crypto_core_VERSION crypto_core_hsalsa20_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_core/hsalsa20/ref2/core_hsalsa20.c

@@ -0,0 +1,108 @@
+/*
+version 20080912
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+
+#define ROUNDS 20
+
+typedef unsigned int uint32;
+
+static uint32 rotate(uint32 u,int c)
+{
+  return (u << c) | (u >> (32 - c));
+}
+
+static uint32 load_littleendian(const unsigned char *x)
+{
+  return
+      (uint32) (x[0]) \
+  | (((uint32) (x[1])) << 8) \
+  | (((uint32) (x[2])) << 16) \
+  | (((uint32) (x[3])) << 24)
+  ;
+}
+
+static void store_littleendian(unsigned char *x,uint32 u)
+{
+  x[0] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[3] = u;
+}
+
+int crypto_core(
+        unsigned char *out,
+  const unsigned char *in,
+  const unsigned char *k,
+  const unsigned char *c
+)
+{
+  uint32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+  int i;
+
+  x0 = load_littleendian(c + 0);
+  x1 = load_littleendian(k + 0);
+  x2 = load_littleendian(k + 4);
+  x3 = load_littleendian(k + 8);
+  x4 = load_littleendian(k + 12);
+  x5 = load_littleendian(c + 4);
+  x6 = load_littleendian(in + 0);
+  x7 = load_littleendian(in + 4);
+  x8 = load_littleendian(in + 8);
+  x9 = load_littleendian(in + 12);
+  x10 = load_littleendian(c + 8);
+  x11 = load_littleendian(k + 16);
+  x12 = load_littleendian(k + 20);
+  x13 = load_littleendian(k + 24);
+  x14 = load_littleendian(k + 28);
+  x15 = load_littleendian(c + 12);
+
+  for (i = ROUNDS;i > 0;i -= 2) {
+     x4 ^= rotate( x0+x12, 7);
+     x8 ^= rotate( x4+ x0, 9);
+    x12 ^= rotate( x8+ x4,13);
+     x0 ^= rotate(x12+ x8,18);
+     x9 ^= rotate( x5+ x1, 7);
+    x13 ^= rotate( x9+ x5, 9);
+     x1 ^= rotate(x13+ x9,13);
+     x5 ^= rotate( x1+x13,18);
+    x14 ^= rotate(x10+ x6, 7);
+     x2 ^= rotate(x14+x10, 9);
+     x6 ^= rotate( x2+x14,13);
+    x10 ^= rotate( x6+ x2,18);
+     x3 ^= rotate(x15+x11, 7);
+     x7 ^= rotate( x3+x15, 9);
+    x11 ^= rotate( x7+ x3,13);
+    x15 ^= rotate(x11+ x7,18);
+     x1 ^= rotate( x0+ x3, 7);
+     x2 ^= rotate( x1+ x0, 9);
+     x3 ^= rotate( x2+ x1,13);
+     x0 ^= rotate( x3+ x2,18);
+     x6 ^= rotate( x5+ x4, 7);
+     x7 ^= rotate( x6+ x5, 9);
+     x4 ^= rotate( x7+ x6,13);
+     x5 ^= rotate( x4+ x7,18);
+    x11 ^= rotate(x10+ x9, 7);
+     x8 ^= rotate(x11+x10, 9);
+     x9 ^= rotate( x8+x11,13);
+    x10 ^= rotate( x9+ x8,18);
+    x12 ^= rotate(x15+x14, 7);
+    x13 ^= rotate(x12+x15, 9);
+    x14 ^= rotate(x13+x12,13);
+    x15 ^= rotate(x14+x13,18);
+  }
+
+  store_littleendian(out + 0,x0);
+  store_littleendian(out + 4,x5);
+  store_littleendian(out + 8,x10);
+  store_littleendian(out + 12,x15);
+  store_littleendian(out + 16,x6);
+  store_littleendian(out + 20,x7);
+  store_littleendian(out + 24,x8);
+  store_littleendian(out + 28,x9);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa20/core_salsa20_api.c

@@ -0,0 +1,26 @@
+#include "crypto_core_salsa20.h"
+
+size_t
+crypto_core_salsa20_outputbytes(void) {
+    return crypto_core_salsa20_OUTPUTBYTES;
+}
+
+size_t
+crypto_core_salsa20_inputbytes(void) {
+    return crypto_core_salsa20_INPUTBYTES;
+}
+
+size_t
+crypto_core_salsa20_keybytes(void) {
+    return crypto_core_salsa20_KEYBYTES;
+}
+
+size_t
+crypto_core_salsa20_constbytes(void) {
+    return crypto_core_salsa20_CONSTBYTES;
+}
+
+const char *
+crypto_core_salsa20_primitive(void) {
+    return "salsa20";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa20/ref/api.h

@@ -0,0 +1,11 @@
+
+#include "crypto_core_salsa20.h"
+
+#define crypto_core crypto_core_salsa20
+#define crypto_core_OUTPUTBYTES crypto_core_salsa20_OUTPUTBYTES
+#define crypto_core_INPUTBYTES crypto_core_salsa20_INPUTBYTES
+#define crypto_core_KEYBYTES crypto_core_salsa20_KEYBYTES
+#define crypto_core_CONSTBYTES crypto_core_salsa20_CONSTBYTES
+#define crypto_core_PRIMITIVE "salsa20"
+#define crypto_core_IMPLEMENTATION crypto_core_salsa20_IMPLEMENTATION
+#define crypto_core_VERSION crypto_core_salsa20_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa20/ref/core_salsa20.c

@@ -0,0 +1,134 @@
+/*
+version 20080912
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+
+#define ROUNDS 20
+
+typedef unsigned int uint32;
+
+static uint32 rotate(uint32 u,int c)
+{
+  return (u << c) | (u >> (32 - c));
+}
+
+static uint32 load_littleendian(const unsigned char *x)
+{
+  return
+      (uint32) (x[0]) \
+  | (((uint32) (x[1])) << 8) \
+  | (((uint32) (x[2])) << 16) \
+  | (((uint32) (x[3])) << 24)
+  ;
+}
+
+static void store_littleendian(unsigned char *x,uint32 u)
+{
+  x[0] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[3] = u;
+}
+
+int crypto_core(
+        unsigned char *out,
+  const unsigned char *in,
+  const unsigned char *k,
+  const unsigned char *c
+)
+{
+  uint32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+  uint32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
+  int i;
+
+  j0 = x0 = load_littleendian(c + 0);
+  j1 = x1 = load_littleendian(k + 0);
+  j2 = x2 = load_littleendian(k + 4);
+  j3 = x3 = load_littleendian(k + 8);
+  j4 = x4 = load_littleendian(k + 12);
+  j5 = x5 = load_littleendian(c + 4);
+  j6 = x6 = load_littleendian(in + 0);
+  j7 = x7 = load_littleendian(in + 4);
+  j8 = x8 = load_littleendian(in + 8);
+  j9 = x9 = load_littleendian(in + 12);
+  j10 = x10 = load_littleendian(c + 8);
+  j11 = x11 = load_littleendian(k + 16);
+  j12 = x12 = load_littleendian(k + 20);
+  j13 = x13 = load_littleendian(k + 24);
+  j14 = x14 = load_littleendian(k + 28);
+  j15 = x15 = load_littleendian(c + 12);
+
+  for (i = ROUNDS;i > 0;i -= 2) {
+     x4 ^= rotate( x0+x12, 7);
+     x8 ^= rotate( x4+ x0, 9);
+    x12 ^= rotate( x8+ x4,13);
+     x0 ^= rotate(x12+ x8,18);
+     x9 ^= rotate( x5+ x1, 7);
+    x13 ^= rotate( x9+ x5, 9);
+     x1 ^= rotate(x13+ x9,13);
+     x5 ^= rotate( x1+x13,18);
+    x14 ^= rotate(x10+ x6, 7);
+     x2 ^= rotate(x14+x10, 9);
+     x6 ^= rotate( x2+x14,13);
+    x10 ^= rotate( x6+ x2,18);
+     x3 ^= rotate(x15+x11, 7);
+     x7 ^= rotate( x3+x15, 9);
+    x11 ^= rotate( x7+ x3,13);
+    x15 ^= rotate(x11+ x7,18);
+     x1 ^= rotate( x0+ x3, 7);
+     x2 ^= rotate( x1+ x0, 9);
+     x3 ^= rotate( x2+ x1,13);
+     x0 ^= rotate( x3+ x2,18);
+     x6 ^= rotate( x5+ x4, 7);
+     x7 ^= rotate( x6+ x5, 9);
+     x4 ^= rotate( x7+ x6,13);
+     x5 ^= rotate( x4+ x7,18);
+    x11 ^= rotate(x10+ x9, 7);
+     x8 ^= rotate(x11+x10, 9);
+     x9 ^= rotate( x8+x11,13);
+    x10 ^= rotate( x9+ x8,18);
+    x12 ^= rotate(x15+x14, 7);
+    x13 ^= rotate(x12+x15, 9);
+    x14 ^= rotate(x13+x12,13);
+    x15 ^= rotate(x14+x13,18);
+  }
+
+  x0 += j0;
+  x1 += j1;
+  x2 += j2;
+  x3 += j3;
+  x4 += j4;
+  x5 += j5;
+  x6 += j6;
+  x7 += j7;
+  x8 += j8;
+  x9 += j9;
+  x10 += j10;
+  x11 += j11;
+  x12 += j12;
+  x13 += j13;
+  x14 += j14;
+  x15 += j15;
+
+  store_littleendian(out + 0,x0);
+  store_littleendian(out + 4,x1);
+  store_littleendian(out + 8,x2);
+  store_littleendian(out + 12,x3);
+  store_littleendian(out + 16,x4);
+  store_littleendian(out + 20,x5);
+  store_littleendian(out + 24,x6);
+  store_littleendian(out + 28,x7);
+  store_littleendian(out + 32,x8);
+  store_littleendian(out + 36,x9);
+  store_littleendian(out + 40,x10);
+  store_littleendian(out + 44,x11);
+  store_littleendian(out + 48,x12);
+  store_littleendian(out + 52,x13);
+  store_littleendian(out + 56,x14);
+  store_littleendian(out + 60,x15);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa2012/core_salsa2012_api.c

@@ -0,0 +1,26 @@
+#include "crypto_core_salsa2012.h"
+
+size_t
+crypto_core_salsa2012_outputbytes(void) {
+    return crypto_core_salsa2012_OUTPUTBYTES;
+}
+
+size_t
+crypto_core_salsa2012_inputbytes(void) {
+    return crypto_core_salsa2012_INPUTBYTES;
+}
+
+size_t
+crypto_core_salsa2012_keybytes(void) {
+    return crypto_core_salsa2012_KEYBYTES;
+}
+
+size_t
+crypto_core_salsa2012_constbytes(void) {
+    return crypto_core_salsa2012_CONSTBYTES;
+}
+
+const char *
+crypto_core_salsa2012_primitive(void) {
+    return "salsa2012";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa2012/ref/api.h

@@ -0,0 +1,11 @@
+
+#include "crypto_core_salsa2012.h"
+
+#define crypto_core crypto_core_salsa2012
+#define crypto_core_OUTPUTBYTES crypto_core_salsa2012_OUTPUTBYTES
+#define crypto_core_INPUTBYTES crypto_core_salsa2012_INPUTBYTES
+#define crypto_core_KEYBYTES crypto_core_salsa2012_KEYBYTES
+#define crypto_core_CONSTBYTES crypto_core_salsa2012_CONSTBYTES
+#define crypto_core_PRIMITIVE "salsa2012"
+#define crypto_core_IMPLEMENTATION crypto_core_salsa2012_IMPLEMENTATION
+#define crypto_core_VERSION crypto_core_salsa2012_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa2012/ref/core_salsa2012.c

@@ -0,0 +1,134 @@
+/*
+version 20080913
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+
+#define ROUNDS 12
+
+typedef unsigned int uint32;
+
+static uint32 rotate(uint32 u,int c)
+{
+  return (u << c) | (u >> (32 - c));
+}
+
+static uint32 load_littleendian(const unsigned char *x)
+{
+  return
+      (uint32) (x[0]) \
+  | (((uint32) (x[1])) << 8) \
+  | (((uint32) (x[2])) << 16) \
+  | (((uint32) (x[3])) << 24)
+  ;
+}
+
+static void store_littleendian(unsigned char *x,uint32 u)
+{
+  x[0] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[3] = u;
+}
+
+int crypto_core(
+        unsigned char *out,
+  const unsigned char *in,
+  const unsigned char *k,
+  const unsigned char *c
+)
+{
+  uint32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+  uint32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
+  int i;
+
+  j0 = x0 = load_littleendian(c + 0);
+  j1 = x1 = load_littleendian(k + 0);
+  j2 = x2 = load_littleendian(k + 4);
+  j3 = x3 = load_littleendian(k + 8);
+  j4 = x4 = load_littleendian(k + 12);
+  j5 = x5 = load_littleendian(c + 4);
+  j6 = x6 = load_littleendian(in + 0);
+  j7 = x7 = load_littleendian(in + 4);
+  j8 = x8 = load_littleendian(in + 8);
+  j9 = x9 = load_littleendian(in + 12);
+  j10 = x10 = load_littleendian(c + 8);
+  j11 = x11 = load_littleendian(k + 16);
+  j12 = x12 = load_littleendian(k + 20);
+  j13 = x13 = load_littleendian(k + 24);
+  j14 = x14 = load_littleendian(k + 28);
+  j15 = x15 = load_littleendian(c + 12);
+
+  for (i = ROUNDS;i > 0;i -= 2) {
+     x4 ^= rotate( x0+x12, 7);
+     x8 ^= rotate( x4+ x0, 9);
+    x12 ^= rotate( x8+ x4,13);
+     x0 ^= rotate(x12+ x8,18);
+     x9 ^= rotate( x5+ x1, 7);
+    x13 ^= rotate( x9+ x5, 9);
+     x1 ^= rotate(x13+ x9,13);
+     x5 ^= rotate( x1+x13,18);
+    x14 ^= rotate(x10+ x6, 7);
+     x2 ^= rotate(x14+x10, 9);
+     x6 ^= rotate( x2+x14,13);
+    x10 ^= rotate( x6+ x2,18);
+     x3 ^= rotate(x15+x11, 7);
+     x7 ^= rotate( x3+x15, 9);
+    x11 ^= rotate( x7+ x3,13);
+    x15 ^= rotate(x11+ x7,18);
+     x1 ^= rotate( x0+ x3, 7);
+     x2 ^= rotate( x1+ x0, 9);
+     x3 ^= rotate( x2+ x1,13);
+     x0 ^= rotate( x3+ x2,18);
+     x6 ^= rotate( x5+ x4, 7);
+     x7 ^= rotate( x6+ x5, 9);
+     x4 ^= rotate( x7+ x6,13);
+     x5 ^= rotate( x4+ x7,18);
+    x11 ^= rotate(x10+ x9, 7);
+     x8 ^= rotate(x11+x10, 9);
+     x9 ^= rotate( x8+x11,13);
+    x10 ^= rotate( x9+ x8,18);
+    x12 ^= rotate(x15+x14, 7);
+    x13 ^= rotate(x12+x15, 9);
+    x14 ^= rotate(x13+x12,13);
+    x15 ^= rotate(x14+x13,18);
+  }
+
+  x0 += j0;
+  x1 += j1;
+  x2 += j2;
+  x3 += j3;
+  x4 += j4;
+  x5 += j5;
+  x6 += j6;
+  x7 += j7;
+  x8 += j8;
+  x9 += j9;
+  x10 += j10;
+  x11 += j11;
+  x12 += j12;
+  x13 += j13;
+  x14 += j14;
+  x15 += j15;
+
+  store_littleendian(out + 0,x0);
+  store_littleendian(out + 4,x1);
+  store_littleendian(out + 8,x2);
+  store_littleendian(out + 12,x3);
+  store_littleendian(out + 16,x4);
+  store_littleendian(out + 20,x5);
+  store_littleendian(out + 24,x6);
+  store_littleendian(out + 28,x7);
+  store_littleendian(out + 32,x8);
+  store_littleendian(out + 36,x9);
+  store_littleendian(out + 40,x10);
+  store_littleendian(out + 44,x11);
+  store_littleendian(out + 48,x12);
+  store_littleendian(out + 52,x13);
+  store_littleendian(out + 56,x14);
+  store_littleendian(out + 60,x15);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa208/core_salsa208_api.c

@@ -0,0 +1,26 @@
+#include "crypto_core_salsa208.h"
+
+size_t
+crypto_core_salsa208_outputbytes(void) {
+    return crypto_core_salsa208_OUTPUTBYTES;
+}
+
+size_t
+crypto_core_salsa208_inputbytes(void) {
+    return crypto_core_salsa208_INPUTBYTES;
+}
+
+size_t
+crypto_core_salsa208_keybytes(void) {
+    return crypto_core_salsa208_KEYBYTES;
+}
+
+size_t
+crypto_core_salsa208_constbytes(void) {
+    return crypto_core_salsa208_CONSTBYTES;
+}
+
+const char *
+crypto_core_salsa208_primitive(void) {
+    return "salsa208";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa208/ref/api.h

@@ -0,0 +1,11 @@
+
+#include "crypto_core_salsa208.h"
+
+#define crypto_core crypto_core_salsa208
+#define crypto_core_OUTPUTBYTES crypto_core_salsa208_OUTPUTBYTES
+#define crypto_core_INPUTBYTES crypto_core_salsa208_INPUTBYTES
+#define crypto_core_KEYBYTES crypto_core_salsa208_KEYBYTES
+#define crypto_core_CONSTBYTES crypto_core_salsa208_CONSTBYTES
+#define crypto_core_PRIMITIVE "salsa208"
+#define crypto_core_IMPLEMENTATION crypto_core_salsa208_IMPLEMENTATION
+#define crypto_core_VERSION crypto_core_salsa208_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_core/salsa208/ref/core_salsa208.c

@@ -0,0 +1,134 @@
+/*
+version 20080913
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+
+#define ROUNDS 8
+
+typedef unsigned int uint32;
+
+static uint32 rotate(uint32 u,int c)
+{
+  return (u << c) | (u >> (32 - c));
+}
+
+static uint32 load_littleendian(const unsigned char *x)
+{
+  return
+      (uint32) (x[0]) \
+  | (((uint32) (x[1])) << 8) \
+  | (((uint32) (x[2])) << 16) \
+  | (((uint32) (x[3])) << 24)
+  ;
+}
+
+static void store_littleendian(unsigned char *x,uint32 u)
+{
+  x[0] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[3] = u;
+}
+
+int crypto_core(
+        unsigned char *out,
+  const unsigned char *in,
+  const unsigned char *k,
+  const unsigned char *c
+)
+{
+  uint32 x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15;
+  uint32 j0, j1, j2, j3, j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15;
+  int i;
+
+  j0 = x0 = load_littleendian(c + 0);
+  j1 = x1 = load_littleendian(k + 0);
+  j2 = x2 = load_littleendian(k + 4);
+  j3 = x3 = load_littleendian(k + 8);
+  j4 = x4 = load_littleendian(k + 12);
+  j5 = x5 = load_littleendian(c + 4);
+  j6 = x6 = load_littleendian(in + 0);
+  j7 = x7 = load_littleendian(in + 4);
+  j8 = x8 = load_littleendian(in + 8);
+  j9 = x9 = load_littleendian(in + 12);
+  j10 = x10 = load_littleendian(c + 8);
+  j11 = x11 = load_littleendian(k + 16);
+  j12 = x12 = load_littleendian(k + 20);
+  j13 = x13 = load_littleendian(k + 24);
+  j14 = x14 = load_littleendian(k + 28);
+  j15 = x15 = load_littleendian(c + 12);
+
+  for (i = ROUNDS;i > 0;i -= 2) {
+     x4 ^= rotate( x0+x12, 7);
+     x8 ^= rotate( x4+ x0, 9);
+    x12 ^= rotate( x8+ x4,13);
+     x0 ^= rotate(x12+ x8,18);
+     x9 ^= rotate( x5+ x1, 7);
+    x13 ^= rotate( x9+ x5, 9);
+     x1 ^= rotate(x13+ x9,13);
+     x5 ^= rotate( x1+x13,18);
+    x14 ^= rotate(x10+ x6, 7);
+     x2 ^= rotate(x14+x10, 9);
+     x6 ^= rotate( x2+x14,13);
+    x10 ^= rotate( x6+ x2,18);
+     x3 ^= rotate(x15+x11, 7);
+     x7 ^= rotate( x3+x15, 9);
+    x11 ^= rotate( x7+ x3,13);
+    x15 ^= rotate(x11+ x7,18);
+     x1 ^= rotate( x0+ x3, 7);
+     x2 ^= rotate( x1+ x0, 9);
+     x3 ^= rotate( x2+ x1,13);
+     x0 ^= rotate( x3+ x2,18);
+     x6 ^= rotate( x5+ x4, 7);
+     x7 ^= rotate( x6+ x5, 9);
+     x4 ^= rotate( x7+ x6,13);
+     x5 ^= rotate( x4+ x7,18);
+    x11 ^= rotate(x10+ x9, 7);
+     x8 ^= rotate(x11+x10, 9);
+     x9 ^= rotate( x8+x11,13);
+    x10 ^= rotate( x9+ x8,18);
+    x12 ^= rotate(x15+x14, 7);
+    x13 ^= rotate(x12+x15, 9);
+    x14 ^= rotate(x13+x12,13);
+    x15 ^= rotate(x14+x13,18);
+  }
+
+  x0 += j0;
+  x1 += j1;
+  x2 += j2;
+  x3 += j3;
+  x4 += j4;
+  x5 += j5;
+  x6 += j6;
+  x7 += j7;
+  x8 += j8;
+  x9 += j9;
+  x10 += j10;
+  x11 += j11;
+  x12 += j12;
+  x13 += j13;
+  x14 += j14;
+  x15 += j15;
+
+  store_littleendian(out + 0,x0);
+  store_littleendian(out + 4,x1);
+  store_littleendian(out + 8,x2);
+  store_littleendian(out + 12,x3);
+  store_littleendian(out + 16,x4);
+  store_littleendian(out + 20,x5);
+  store_littleendian(out + 24,x6);
+  store_littleendian(out + 28,x7);
+  store_littleendian(out + 32,x8);
+  store_littleendian(out + 36,x9);
+  store_littleendian(out + 40,x10);
+  store_littleendian(out + 44,x11);
+  store_littleendian(out + 48,x12);
+  store_littleendian(out + 52,x13);
+  store_littleendian(out + 56,x14);
+  store_littleendian(out + 60,x15);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/generichash_blake2_api.c

@@ -0,0 +1,31 @@
+#include "crypto_generichash_blake2b.h"
+
+size_t
+crypto_generichash_blake2b_bytes_min(void) {
+    return crypto_generichash_blake2b_BYTES_MIN;
+}
+
+size_t
+crypto_generichash_blake2b_bytes_max(void) {
+    return crypto_generichash_blake2b_BYTES_MAX;
+}
+
+size_t
+crypto_generichash_blake2b_keybytes_min(void) {
+    return crypto_generichash_blake2b_KEYBYTES_MIN;
+}
+
+size_t
+crypto_generichash_blake2b_keybytes_max(void) {
+    return crypto_generichash_blake2b_KEYBYTES_MAX;
+}
+
+size_t
+crypto_generichash_blake2b_blockbytes(void) {
+    return crypto_generichash_blake2b_BLOCKBYTES;
+}
+
+const char *
+crypto_generichash_blake2b_blockbytes_primitive(void) {
+    return "blake2b";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/ref/api.h

@@ -0,0 +1,4 @@
+
+#include "crypto_generichash_blake2b.h"
+
+#define crypto_generichash_blake2b crypto_generichash_blake2b_ref

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/ref/blake2-impl.h

@@ -0,0 +1,132 @@
+/*
+   BLAKE2 reference source code package - reference C implementations
+
+   Written in 2012 by Samuel Neves <sneves@dei.uc.pt>
+
+   To the extent possible under law, the author(s) have dedicated all copyright
+   and related and neighboring rights to this software to the public domain
+   worldwide. This software is distributed without any warranty.
+
+   You should have received a copy of the CC0 Public Domain Dedication along with
+   this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+*/
+
+#ifndef __BLAKE2_IMPL_H__
+#define __BLAKE2_IMPL_H__
+
+#include <stdint.h>
+
+#include "utils.h"
+
+static inline uint32_t load32( const void *src )
+{
+#if defined(NATIVE_LITTLE_ENDIAN)
+  return *( uint32_t * )( src );
+#else
+  const uint8_t *p = ( const uint8_t * )src;
+  uint32_t w = *p++;
+  w |= ( uint32_t )( *p++ ) <<  8;
+  w |= ( uint32_t )( *p++ ) << 16;
+  w |= ( uint32_t )( *p++ ) << 24;
+  return w;
+#endif
+}
+
+static inline uint64_t load64( const void *src )
+{
+#if defined(NATIVE_LITTLE_ENDIAN)
+  return *( uint64_t * )( src );
+#else
+  const uint8_t *p = ( const uint8_t * )src;
+  uint64_t w = *p++;
+  w |= ( uint64_t )( *p++ ) <<  8;
+  w |= ( uint64_t )( *p++ ) << 16;
+  w |= ( uint64_t )( *p++ ) << 24;
+  w |= ( uint64_t )( *p++ ) << 32;
+  w |= ( uint64_t )( *p++ ) << 40;
+  w |= ( uint64_t )( *p++ ) << 48;
+  w |= ( uint64_t )( *p++ ) << 56;
+  return w;
+#endif
+}
+
+static inline void store32( void *dst, uint32_t w )
+{
+#if defined(NATIVE_LITTLE_ENDIAN)
+  *( uint32_t * )( dst ) = w;
+#else
+  uint8_t *p = ( uint8_t * )dst;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w;
+#endif
+}
+
+static inline void store64( void *dst, uint64_t w )
+{
+#if defined(NATIVE_LITTLE_ENDIAN)
+  *( uint64_t * )( dst ) = w;
+#else
+  uint8_t *p = ( uint8_t * )dst;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w;
+#endif
+}
+
+static inline uint64_t load48( const void *src )
+{
+  const uint8_t *p = ( const uint8_t * )src;
+  uint64_t w = *p++;
+  w |= ( uint64_t )( *p++ ) <<  8;
+  w |= ( uint64_t )( *p++ ) << 16;
+  w |= ( uint64_t )( *p++ ) << 24;
+  w |= ( uint64_t )( *p++ ) << 32;
+  w |= ( uint64_t )( *p++ ) << 40;
+  return w;
+}
+
+static inline void store48( void *dst, uint64_t w )
+{
+  uint8_t *p = ( uint8_t * )dst;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w; w >>= 8;
+  *p++ = ( uint8_t )w;
+}
+
+static inline uint32_t rotl32( const uint32_t w, const unsigned c )
+{
+  return ( w << c ) | ( w >> ( 32 - c ) );
+}
+
+static inline uint64_t rotl64( const uint64_t w, const unsigned c )
+{
+  return ( w << c ) | ( w >> ( 64 - c ) );
+}
+
+static inline uint32_t rotr32( const uint32_t w, const unsigned c )
+{
+  return ( w >> c ) | ( w << ( 32 - c ) );
+}
+
+static inline uint64_t rotr64( const uint64_t w, const unsigned c )
+{
+  return ( w >> c ) | ( w << ( 64 - c ) );
+}
+
+/* prevents compiler optimizing out memset() */
+static inline void secure_zero_memory( void *v, size_t n )
+{
+  sodium_memzero(v, n);
+}
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/ref/blake2.h

@@ -0,0 +1,169 @@
+/*
+   BLAKE2 reference source code package - reference C implementations
+
+   Written in 2012 by Samuel Neves <sneves@dei.uc.pt>
+
+   To the extent possible under law, the author(s) have dedicated all copyright
+   and related and neighboring rights to this software to the public domain
+   worldwide. This software is distributed without any warranty.
+
+   You should have received a copy of the CC0 Public Domain Dedication along with
+   this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+*/
+
+#ifndef __BLAKE2_H__
+#define __BLAKE2_H__
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include "crypto_generichash_blake2b.h"
+
+#define blake2b_init_param crypto_generichash_blake2b__init_param
+#define blake2b_init       crypto_generichash_blake2b__init
+#define blake2b_init_key   crypto_generichash_blake2b__init_key
+#define blake2b_update     crypto_generichash_blake2b__update
+#define blake2b_final      crypto_generichash_blake2b__final
+#define blake2b            crypto_generichash_blake2b__blake2b
+
+#if defined(_MSC_VER)
+#define ALIGN(x) __declspec(align(x))
+#else
+#define ALIGN(x) __attribute__((aligned(x)))
+#endif
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+  enum blake2s_constant
+  {
+    BLAKE2S_BLOCKBYTES = 64,
+    BLAKE2S_OUTBYTES   = 32,
+    BLAKE2S_KEYBYTES   = 32,
+    BLAKE2S_SALTBYTES  = 8,
+    BLAKE2S_PERSONALBYTES = 8
+  };
+
+  enum blake2b_constant
+  {
+    BLAKE2B_BLOCKBYTES = 128,
+    BLAKE2B_OUTBYTES   = 64,
+    BLAKE2B_KEYBYTES   = 64,
+    BLAKE2B_SALTBYTES  = 16,
+    BLAKE2B_PERSONALBYTES = 16
+  };
+
+#pragma pack(push, 1)
+  typedef struct __blake2s_param
+  {
+    uint8_t  digest_length; // 1
+    uint8_t  key_length;    // 2
+    uint8_t  fanout;        // 3
+    uint8_t  depth;         // 4
+    uint32_t leaf_length;   // 8
+    uint8_t  node_offset[6];// 14
+    uint8_t  node_depth;    // 15
+    uint8_t  inner_length;  // 16
+    // uint8_t  reserved[0];
+    uint8_t  salt[BLAKE2S_SALTBYTES]; // 24
+    uint8_t  personal[BLAKE2S_PERSONALBYTES];  // 32
+  } blake2s_param;
+
+  ALIGN( 64 ) typedef struct __blake2s_state
+  {
+    uint32_t h[8];
+    uint32_t t[2];
+    uint32_t f[2];
+    uint8_t  buf[2 * BLAKE2S_BLOCKBYTES];
+    size_t   buflen;
+    uint8_t  last_node;
+  } blake2s_state ;
+
+  typedef struct __blake2b_param
+  {
+    uint8_t  digest_length; // 1
+    uint8_t  key_length;    // 2
+    uint8_t  fanout;        // 3
+    uint8_t  depth;         // 4
+    uint32_t leaf_length;   // 8
+    uint64_t node_offset;   // 16
+    uint8_t  node_depth;    // 17
+    uint8_t  inner_length;  // 18
+    uint8_t  reserved[14];  // 32
+    uint8_t  salt[BLAKE2B_SALTBYTES]; // 48
+    uint8_t  personal[BLAKE2B_PERSONALBYTES];  // 64
+  } blake2b_param;
+
+#ifndef DEFINE_BLAKE2B_STATE
+typedef crypto_generichash_blake2b_state blake2b_state;
+#else
+  ALIGN( 64 ) typedef struct __blake2b_state
+  {
+    uint64_t h[8];
+    uint64_t t[2];
+    uint64_t f[2];
+    uint8_t  buf[2 * BLAKE2B_BLOCKBYTES];
+    size_t   buflen;
+    uint8_t  last_node;
+  } blake2b_state;
+#endif
+
+  typedef struct __blake2sp_state
+  {
+    blake2s_state S[8][1];
+    blake2s_state R[1];
+    uint8_t buf[8 * BLAKE2S_BLOCKBYTES];
+    size_t  buflen;
+  } blake2sp_state;
+
+  typedef struct __blake2bp_state
+  {
+    blake2b_state S[4][1];
+    blake2b_state R[1];
+    uint8_t buf[4 * BLAKE2B_BLOCKBYTES];
+    size_t  buflen;
+  } blake2bp_state;
+#pragma pack(pop)
+
+  // Streaming API
+  int blake2s_init( blake2s_state *S, const uint8_t outlen );
+  int blake2s_init_key( blake2s_state *S, const uint8_t outlen, const void *key, const uint8_t keylen );
+  int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
+  int blake2s_update( blake2s_state *S, const uint8_t *in, uint64_t inlen );
+  int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen );
+
+  int blake2b_init( blake2b_state *S, const uint8_t outlen );
+  int blake2b_init_key( blake2b_state *S, const uint8_t outlen, const void *key, const uint8_t keylen );
+  int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
+  int blake2b_update( blake2b_state *S, const uint8_t *in, uint64_t inlen );
+  int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen );
+
+  int blake2sp_init( blake2sp_state *S, const uint8_t outlen );
+  int blake2sp_init_key( blake2sp_state *S, const uint8_t outlen, const void *key, const uint8_t keylen );
+  int blake2sp_update( blake2sp_state *S, const uint8_t *in, uint64_t inlen );
+  int blake2sp_final( blake2sp_state *S, uint8_t *out, uint8_t outlen );
+
+  int blake2bp_init( blake2bp_state *S, const uint8_t outlen );
+  int blake2bp_init_key( blake2bp_state *S, const uint8_t outlen, const void *key, const uint8_t keylen );
+  int blake2bp_update( blake2bp_state *S, const uint8_t *in, uint64_t inlen );
+  int blake2bp_final( blake2bp_state *S, uint8_t *out, uint8_t outlen );
+
+  // Simple API
+  int blake2s( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen );
+  int blake2b( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen );
+
+  int blake2sp( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen );
+  int blake2bp( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen );
+
+  static inline int blake2( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen )
+  {
+    return blake2b( out, in, key, outlen, inlen, keylen );
+  }
+
+#if defined(__cplusplus)
+}
+#endif
+
+#endif
+

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/ref/blake2b-ref.c

@@ -0,0 +1,364 @@
+/*
+   BLAKE2 reference source code package - reference C implementations
+
+   Written in 2012 by Samuel Neves <sneves@dei.uc.pt>
+
+   To the extent possible under law, the author(s) have dedicated all copyright
+   and related and neighboring rights to this software to the public domain
+   worldwide. This software is distributed without any warranty.
+
+   You should have received a copy of the CC0 Public Domain Dedication along with
+   this software. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+*/
+
+#include <stdint.h>
+#include <string.h>
+#include <stdio.h>
+
+#include "blake2.h"
+#include "blake2-impl.h"
+
+static const uint64_t blake2b_IV[8] =
+{
+  0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL,
+  0x3c6ef372fe94f82bULL, 0xa54ff53a5f1d36f1ULL,
+  0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
+  0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
+};
+
+static const uint8_t blake2b_sigma[12][16] =
+{
+  {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 } ,
+  { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 } ,
+  { 11,  8, 12,  0,  5,  2, 15, 13, 10, 14,  3,  6,  7,  1,  9,  4 } ,
+  {  7,  9,  3,  1, 13, 12, 11, 14,  2,  6,  5, 10,  4,  0, 15,  8 } ,
+  {  9,  0,  5,  7,  2,  4, 10, 15, 14,  1, 11, 12,  6,  8,  3, 13 } ,
+  {  2, 12,  6, 10,  0, 11,  8,  3,  4, 13,  7,  5, 15, 14,  1,  9 } ,
+  { 12,  5,  1, 15, 14, 13,  4, 10,  0,  7,  6,  3,  9,  2,  8, 11 } ,
+  { 13, 11,  7, 14, 12,  1,  3,  9,  5,  0, 15,  4,  8,  6,  2, 10 } ,
+  {  6, 15, 14,  9, 11,  3,  0,  8, 12,  2, 13,  7,  1,  4, 10,  5 } ,
+  { 10,  2,  8,  4,  7,  6,  1,  5, 15, 11,  9, 14,  3, 12, 13 , 0 } ,
+  {  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 15 } ,
+  { 14, 10,  4,  8,  9, 15, 13,  6,  1, 12,  0,  2, 11,  7,  5,  3 }
+};
+
+
+static inline int blake2b_set_lastnode( blake2b_state *S )
+{
+  S->f[1] = ~0ULL;
+  return 0;
+}
+
+static inline int blake2b_clear_lastnode( blake2b_state *S )
+{
+  S->f[1] = 0ULL;
+  return 0;
+}
+
+/* Some helper functions, not necessarily useful */
+static inline int blake2b_set_lastblock( blake2b_state *S )
+{
+  if( S->last_node ) blake2b_set_lastnode( S );
+
+  S->f[0] = ~0ULL;
+  return 0;
+}
+
+static inline int blake2b_clear_lastblock( blake2b_state *S )
+{
+  if( S->last_node ) blake2b_clear_lastnode( S );
+
+  S->f[0] = 0ULL;
+  return 0;
+}
+
+static inline int blake2b_increment_counter( blake2b_state *S, const uint64_t inc )
+{
+  S->t[0] += inc;
+  S->t[1] += ( S->t[0] < inc );
+  return 0;
+}
+
+
+
+// Parameter-related functions
+static inline int blake2b_param_set_digest_length( blake2b_param *P, const uint8_t digest_length )
+{
+  P->digest_length = digest_length;
+  return 0;
+}
+
+static inline int blake2b_param_set_fanout( blake2b_param *P, const uint8_t fanout )
+{
+  P->fanout = fanout;
+  return 0;
+}
+
+static inline int blake2b_param_set_max_depth( blake2b_param *P, const uint8_t depth )
+{
+  P->depth = depth;
+  return 0;
+}
+
+static inline int blake2b_param_set_leaf_length( blake2b_param *P, const uint32_t leaf_length )
+{
+  store32( &P->leaf_length, leaf_length );
+  return 0;
+}
+
+static inline int blake2b_param_set_node_offset( blake2b_param *P, const uint64_t node_offset )
+{
+  store64( &P->node_offset, node_offset );
+  return 0;
+}
+
+static inline int blake2b_param_set_node_depth( blake2b_param *P, const uint8_t node_depth )
+{
+  P->node_depth = node_depth;
+  return 0;
+}
+
+static inline int blake2b_param_set_inner_length( blake2b_param *P, const uint8_t inner_length )
+{
+  P->inner_length = inner_length;
+  return 0;
+}
+
+static inline int blake2b_param_set_salt( blake2b_param *P, const uint8_t salt[BLAKE2B_SALTBYTES] )
+{
+  memcpy( P->salt, salt, BLAKE2B_SALTBYTES );
+  return 0;
+}
+
+static inline int blake2b_param_set_personal( blake2b_param *P, const uint8_t personal[BLAKE2B_PERSONALBYTES] )
+{
+  memcpy( P->personal, personal, BLAKE2B_PERSONALBYTES );
+  return 0;
+}
+
+static inline int blake2b_init0( blake2b_state *S )
+{
+  int i;
+  memset( S, 0, sizeof( blake2b_state ) );
+
+  for( i = 0; i < 8; ++i ) S->h[i] = blake2b_IV[i];
+
+  return 0;
+}
+
+/* init xors IV with input parameter block */
+int blake2b_init_param( blake2b_state *S, const blake2b_param *P )
+{
+  size_t i;
+  const uint8_t *p;
+
+  blake2b_init0( S );
+  p = ( const uint8_t * )( P );
+
+  /* IV XOR ParamBlock */
+  for( i = 0; i < 8; ++i )
+    S->h[i] ^= load64( p + sizeof( S->h[i] ) * i );
+
+  return 0;
+}
+
+
+
+int blake2b_init( blake2b_state *S, const uint8_t outlen )
+{
+  blake2b_param P[1];
+
+  if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1;
+
+  P->digest_length = outlen;
+  P->key_length    = 0;
+  P->fanout        = 1;
+  P->depth         = 1;
+  store32( &P->leaf_length, 0 );
+  store64( &P->node_offset, 0 );
+  P->node_depth    = 0;
+  P->inner_length  = 0;
+  memset( P->reserved, 0, sizeof( P->reserved ) );
+  memset( P->salt,     0, sizeof( P->salt ) );
+  memset( P->personal, 0, sizeof( P->personal ) );
+  return blake2b_init_param( S, P );
+}
+
+
+int blake2b_init_key( blake2b_state *S, const uint8_t outlen, const void *key, const uint8_t keylen )
+{
+  blake2b_param P[1];
+
+  if ( ( !outlen ) || ( outlen > BLAKE2B_OUTBYTES ) ) return -1;
+
+  if ( !key || !keylen || keylen > BLAKE2B_KEYBYTES ) return -1;
+
+  P->digest_length = outlen;
+  P->key_length    = keylen;
+  P->fanout        = 1;
+  P->depth         = 1;
+  store32( &P->leaf_length, 0 );
+  store64( &P->node_offset, 0 );
+  P->node_depth    = 0;
+  P->inner_length  = 0;
+  memset( P->reserved, 0, sizeof( P->reserved ) );
+  memset( P->salt,     0, sizeof( P->salt ) );
+  memset( P->personal, 0, sizeof( P->personal ) );
+
+  if( blake2b_init_param( S, P ) < 0 ) return -1;
+
+  {
+    uint8_t block[BLAKE2B_BLOCKBYTES];
+    memset( block, 0, BLAKE2B_BLOCKBYTES );
+    memcpy( block, key, keylen );
+    blake2b_update( S, block, BLAKE2B_BLOCKBYTES );
+    secure_zero_memory( block, BLAKE2B_BLOCKBYTES ); /* Burn the key from stack */
+  }
+  return 0;
+}
+
+static int blake2b_compress( blake2b_state *S, const uint8_t block[BLAKE2B_BLOCKBYTES] )
+{
+  uint64_t m[16];
+  uint64_t v[16];
+  int      i;
+
+  for( i = 0; i < 16; ++i )
+    m[i] = load64( block + i * sizeof( m[i] ) );
+
+  for( i = 0; i < 8; ++i )
+    v[i] = S->h[i];
+
+  v[ 8] = blake2b_IV[0];
+  v[ 9] = blake2b_IV[1];
+  v[10] = blake2b_IV[2];
+  v[11] = blake2b_IV[3];
+  v[12] = S->t[0] ^ blake2b_IV[4];
+  v[13] = S->t[1] ^ blake2b_IV[5];
+  v[14] = S->f[0] ^ blake2b_IV[6];
+  v[15] = S->f[1] ^ blake2b_IV[7];
+#define G(r,i,a,b,c,d) \
+  do { \
+    a = a + b + m[blake2b_sigma[r][2*i+0]]; \
+    d = rotr64(d ^ a, 32); \
+    c = c + d; \
+    b = rotr64(b ^ c, 24); \
+    a = a + b + m[blake2b_sigma[r][2*i+1]]; \
+    d = rotr64(d ^ a, 16); \
+    c = c + d; \
+    b = rotr64(b ^ c, 63); \
+  } while(0)
+#define ROUND(r)  \
+  do { \
+    G(r,0,v[ 0],v[ 4],v[ 8],v[12]); \
+    G(r,1,v[ 1],v[ 5],v[ 9],v[13]); \
+    G(r,2,v[ 2],v[ 6],v[10],v[14]); \
+    G(r,3,v[ 3],v[ 7],v[11],v[15]); \
+    G(r,4,v[ 0],v[ 5],v[10],v[15]); \
+    G(r,5,v[ 1],v[ 6],v[11],v[12]); \
+    G(r,6,v[ 2],v[ 7],v[ 8],v[13]); \
+    G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
+  } while(0)
+  ROUND( 0 );
+  ROUND( 1 );
+  ROUND( 2 );
+  ROUND( 3 );
+  ROUND( 4 );
+  ROUND( 5 );
+  ROUND( 6 );
+  ROUND( 7 );
+  ROUND( 8 );
+  ROUND( 9 );
+  ROUND( 10 );
+  ROUND( 11 );
+
+  for( i = 0; i < 8; ++i )
+    S->h[i] = S->h[i] ^ v[i] ^ v[i + 8];
+
+#undef G
+#undef ROUND
+  return 0;
+}
+
+/* inlen now in bytes */
+int blake2b_update( blake2b_state *S, const uint8_t *in, uint64_t inlen )
+{
+  while( inlen > 0 )
+  {
+    size_t left = S->buflen;
+    size_t fill = 2 * BLAKE2B_BLOCKBYTES - left;
+
+    if( inlen > fill )
+    {
+      memcpy( S->buf + left, in, fill ); // Fill buffer
+      S->buflen += fill;
+      blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
+      blake2b_compress( S, S->buf ); // Compress
+      memcpy( S->buf, S->buf + BLAKE2B_BLOCKBYTES, BLAKE2B_BLOCKBYTES ); // Shift buffer left
+      S->buflen -= BLAKE2B_BLOCKBYTES;
+      in += fill;
+      inlen -= fill;
+    }
+    else // inlen <= fill
+    {
+      memcpy( S->buf + left, in, inlen );
+      S->buflen += inlen; // Be lazy, do not compress
+      in += inlen;
+      inlen -= inlen;
+    }
+  }
+
+  return 0;
+}
+
+/* Is this correct? */
+int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen )
+{
+  uint8_t buffer[BLAKE2B_OUTBYTES];
+  int     i;
+
+  if( S->buflen > BLAKE2B_BLOCKBYTES )
+  {
+    blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
+    blake2b_compress( S, S->buf );
+    S->buflen -= BLAKE2B_BLOCKBYTES;
+    memcpy( S->buf, S->buf + BLAKE2B_BLOCKBYTES, S->buflen );
+  }
+
+  blake2b_increment_counter( S, S->buflen );
+  blake2b_set_lastblock( S );
+  memset( S->buf + S->buflen, 0, 2 * BLAKE2B_BLOCKBYTES - S->buflen ); /* Padding */
+  blake2b_compress( S, S->buf );
+
+  for( i = 0; i < 8; ++i ) /* Output full hash to temp buffer */
+    store64( buffer + sizeof( S->h[i] ) * i, S->h[i] );
+
+  memcpy( out, buffer, outlen );
+  return 0;
+}
+
+/* inlen, at least, should be uint64_t. Others can be size_t. */
+int blake2b( uint8_t *out, const void *in, const void *key, const uint8_t outlen, const uint64_t inlen, uint8_t keylen )
+{
+  blake2b_state S[1];
+
+  /* Verify parameters */
+  if ( NULL == in ) return -1;
+
+  if ( NULL == out ) return -1;
+
+  if( NULL == key ) keylen = 0;
+
+  if( keylen > 0 )
+  {
+    if( blake2b_init_key( S, outlen, key, keylen ) < 0 ) return -1;
+  }
+  else
+  {
+    if( blake2b_init( S, outlen ) < 0 ) return -1;
+  }
+
+  blake2b_update( S, ( const uint8_t * )in, inlen );
+  blake2b_final( S, out, outlen );
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/blake2/ref/generichash_blake2b.c

@@ -0,0 +1,61 @@
+
+#include <assert.h>
+#include <limits.h>
+#include <stdint.h>
+
+#include "api.h"
+#include "blake2.h"
+
+int
+crypto_generichash_blake2b(unsigned char *out, size_t outlen,
+                           const unsigned char *in, unsigned long long inlen,
+                           const unsigned char *key, size_t keylen)
+{
+    if (outlen <= 0U || outlen > BLAKE2B_OUTBYTES ||
+        keylen > BLAKE2B_KEYBYTES || inlen > UINT64_MAX) {
+        return -1;
+    }
+    assert(outlen <= UINT8_MAX);
+    assert(keylen <= UINT8_MAX);
+
+    return blake2b((uint8_t *) out, in, key,
+                   (uint8_t) outlen, (uint64_t) inlen, (uint8_t) keylen);
+}
+
+int
+crypto_generichash_blake2b_init(crypto_generichash_blake2b_state *state,
+                                const unsigned char *key,
+                                const size_t keylen, const size_t outlen)
+{
+    if (outlen <= 0U || outlen > BLAKE2B_OUTBYTES ||
+        keylen > BLAKE2B_KEYBYTES) {
+        return -1;
+    }
+    assert(outlen <= UINT8_MAX);
+    assert(keylen <= UINT8_MAX);
+    if (blake2b_init(state, (uint8_t) outlen) != 0) {
+        return -1;
+    }
+    if (key != NULL && keylen > 0U &&
+        blake2b_init_key(state, (uint8_t) outlen, key, keylen) != 0) {
+        return -1;
+    }
+    return 0;
+}
+
+int
+crypto_generichash_blake2b_update(crypto_generichash_blake2b_state *state,
+                                  const unsigned char *in,
+                                  unsigned long long inlen)
+{
+    return blake2b_update(state, (const uint8_t *) in, (uint64_t) inlen);
+}
+
+int
+crypto_generichash_blake2b_final(crypto_generichash_blake2b_state *state,
+                                 unsigned char *out,
+                                 const size_t outlen)
+{
+    assert(outlen <= UINT8_MAX);
+    return blake2b_final(state, (uint8_t *) out, (uint8_t) outlen);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_generichash/crypto_generichash.c

@@ -0,0 +1,84 @@
+
+#include "crypto_generichash.h"
+
+size_t
+crypto_generichash_bytes(void)
+{
+    return crypto_generichash_BYTES;
+}
+
+size_t
+crypto_generichash_bytes_min(void)
+{
+    return crypto_generichash_BYTES_MIN;
+}
+
+size_t
+crypto_generichash_bytes_max(void)
+{
+    return crypto_generichash_BYTES_MAX;
+}
+
+size_t
+crypto_generichash_keybytes(void)
+{
+    return crypto_generichash_KEYBYTES;
+}
+
+size_t
+crypto_generichash_keybytes_min(void)
+{
+    return crypto_generichash_KEYBYTES_MIN;
+}
+
+size_t
+crypto_generichash_keybytes_max(void)
+{
+    return crypto_generichash_KEYBYTES_MAX;
+}
+
+size_t
+crypto_generichash_blockbytes(void)
+{
+    return crypto_generichash_BLOCKBYTES;
+}
+
+const char *crypto_generichash_primitive(void)
+{
+    return crypto_generichash_PRIMITIVE;
+}
+
+int
+crypto_generichash(unsigned char *out, size_t outlen, const unsigned char *in,
+                   unsigned long long inlen, const unsigned char *key,
+                   size_t keylen)
+{
+    return crypto_generichash_blake2b(out, outlen, in, inlen, key, keylen);
+}
+
+int
+crypto_generichash_init(crypto_generichash_state *state,
+                        const unsigned char *key,
+                        const size_t keylen, const size_t outlen)
+{
+    return crypto_generichash_blake2b_init
+        ((crypto_generichash_blake2b_state *) state,
+            key, keylen, outlen);
+}
+
+int
+crypto_generichash_update(crypto_generichash_state *state,
+                          const unsigned char *in,
+                          unsigned long long inlen)
+{
+    return crypto_generichash_blake2b_update
+        ((crypto_generichash_blake2b_state *) state, in, inlen);
+}
+
+int
+crypto_generichash_final(crypto_generichash_state *state,
+                         unsigned char *out, const size_t outlen)
+{
+    return crypto_generichash_blake2b_final
+        ((crypto_generichash_blake2b_state *) state, out, outlen);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/crypto_hash.c

@@ -0,0 +1,9 @@
+
+#include "crypto_hash.h"
+
+int
+crypto_hash(unsigned char *out, const unsigned char *in,
+            unsigned long long inlen)
+{
+    return crypto_hash_sha512(out, in, inlen);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha256/hash_sha256_api.c

@@ -0,0 +1,11 @@
+#include "crypto_hash_sha256.h"
+
+size_t
+crypto_hash_sha256_bytes(void) {
+    return crypto_hash_sha256_BYTES;
+}
+
+const char *
+crypto_hash_sha256_primitive(void) {
+    return "sha256";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha256/ref/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_hash_sha256.h"
+
+#define crypto_hash crypto_hash_sha256
+#define crypto_hash_BYTES crypto_hash_sha256_BYTES
+#define crypto_hash_PRIMITIVE "sha256"
+#define crypto_hash_IMPLEMENTATION crypto_hash_sha256_IMPLEMENTATION
+#define crypto_hash_VERSION crypto_hash_sha256_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha256/ref/hash_sha256.c

@@ -0,0 +1,69 @@
+/*
+20080913
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+#include "crypto_hashblocks_sha256.h"
+
+#define blocks crypto_hashblocks_sha256
+
+typedef unsigned int uint32;
+
+static const unsigned char iv[32] = {
+  0x6a,0x09,0xe6,0x67,
+  0xbb,0x67,0xae,0x85,
+  0x3c,0x6e,0xf3,0x72,
+  0xa5,0x4f,0xf5,0x3a,
+  0x51,0x0e,0x52,0x7f,
+  0x9b,0x05,0x68,0x8c,
+  0x1f,0x83,0xd9,0xab,
+  0x5b,0xe0,0xcd,0x19,
+} ;
+
+int crypto_hash(unsigned char *out,const unsigned char *in,unsigned long long inlen)
+{
+  unsigned char h[32];
+  unsigned char padded[128];
+  unsigned long long i;
+  unsigned long long bits = inlen << 3;
+
+  for (i = 0;i < 32;++i) h[i] = iv[i];
+
+  blocks(h,in,inlen);
+  in += inlen;
+  inlen &= 63;
+  in -= inlen;
+
+  for (i = 0;i < inlen;++i) padded[i] = in[i];
+  padded[inlen] = 0x80;
+
+  if (inlen < 56) {
+    for (i = inlen + 1;i < 56;++i) padded[i] = 0;
+    padded[56] = bits >> 56;
+    padded[57] = bits >> 48;
+    padded[58] = bits >> 40;
+    padded[59] = bits >> 32;
+    padded[60] = bits >> 24;
+    padded[61] = bits >> 16;
+    padded[62] = bits >> 8;
+    padded[63] = bits;
+    blocks(h,padded,64);
+  } else {
+    for (i = inlen + 1;i < 120;++i) padded[i] = 0;
+    padded[120] = bits >> 56;
+    padded[121] = bits >> 48;
+    padded[122] = bits >> 40;
+    padded[123] = bits >> 32;
+    padded[124] = bits >> 24;
+    padded[125] = bits >> 16;
+    padded[126] = bits >> 8;
+    padded[127] = bits;
+    blocks(h,padded,128);
+  }
+
+  for (i = 0;i < 32;++i) out[i] = h[i];
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha512/hash_sha512_api.c

@@ -0,0 +1,11 @@
+#include "crypto_hash_sha512.h"
+
+size_t
+crypto_hash_sha512_bytes(void) {
+    return crypto_hash_sha512_BYTES;
+}
+
+const char *
+crypto_hash_sha512_primitive(void) {
+    return "sha512";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha512/ref/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_hash_sha512.h"
+
+#define crypto_hash crypto_hash_sha512
+#define crypto_hash_BYTES crypto_hash_sha512_BYTES
+#define crypto_hash_PRIMITIVE "sha512"
+#define crypto_hash_IMPLEMENTATION crypto_hash_sha512_IMPLEMENTATION
+#define crypto_hash_VERSION crypto_hash_sha512_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_hash/sha512/ref/hash_sha512.c

@@ -0,0 +1,71 @@
+/*
+20080913
+D. J. Bernstein
+Public domain.
+*/
+
+#include "api.h"
+#include "crypto_hashblocks_sha512.h"
+
+#define blocks crypto_hashblocks_sha512
+
+static const unsigned char iv[64] = {
+  0x6a,0x09,0xe6,0x67,0xf3,0xbc,0xc9,0x08,
+  0xbb,0x67,0xae,0x85,0x84,0xca,0xa7,0x3b,
+  0x3c,0x6e,0xf3,0x72,0xfe,0x94,0xf8,0x2b,
+  0xa5,0x4f,0xf5,0x3a,0x5f,0x1d,0x36,0xf1,
+  0x51,0x0e,0x52,0x7f,0xad,0xe6,0x82,0xd1,
+  0x9b,0x05,0x68,0x8c,0x2b,0x3e,0x6c,0x1f,
+  0x1f,0x83,0xd9,0xab,0xfb,0x41,0xbd,0x6b,
+  0x5b,0xe0,0xcd,0x19,0x13,0x7e,0x21,0x79
+} ;
+
+typedef unsigned long long uint64;
+
+int crypto_hash(unsigned char *out,const unsigned char *in,unsigned long long inlen)
+{
+  unsigned char h[64];
+  unsigned char padded[256];
+  unsigned long long i;
+  unsigned long long bytes = inlen;
+
+  for (i = 0;i < 64;++i) h[i] = iv[i];
+
+  blocks(h,in,inlen);
+  in += inlen;
+  inlen &= 127;
+  in -= inlen;
+
+  for (i = 0;i < inlen;++i) padded[i] = in[i];
+  padded[inlen] = 0x80;
+
+  if (inlen < 112) {
+    for (i = inlen + 1;i < 119;++i) padded[i] = 0;
+    padded[119] = bytes >> 61;
+    padded[120] = bytes >> 53;
+    padded[121] = bytes >> 45;
+    padded[122] = bytes >> 37;
+    padded[123] = bytes >> 29;
+    padded[124] = bytes >> 21;
+    padded[125] = bytes >> 13;
+    padded[126] = bytes >> 5;
+    padded[127] = bytes << 3;
+    blocks(h,padded,128);
+  } else {
+    for (i = inlen + 1;i < 247;++i) padded[i] = 0;
+    padded[247] = bytes >> 61;
+    padded[248] = bytes >> 53;
+    padded[249] = bytes >> 45;
+    padded[250] = bytes >> 37;
+    padded[251] = bytes >> 29;
+    padded[252] = bytes >> 21;
+    padded[253] = bytes >> 13;
+    padded[254] = bytes >> 5;
+    padded[255] = bytes << 3;
+    blocks(h,padded,256);
+  }
+
+  for (i = 0;i < 64;++i) out[i] = h[i];
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha256/hashblocks_sha256_api.c

@@ -0,0 +1,16 @@
+#include "crypto_hashblocks_sha256.h"
+
+size_t
+crypto_hashblocks_sha256_statebytes(void) {
+    return crypto_hashblocks_sha256_STATEBYTES;
+}
+
+size_t
+crypto_hashblocks_sha256_blockbytes(void) {
+    return crypto_hashblocks_sha256_BLOCKBYTES;
+}
+
+const char *
+crypto_hashblocks_sha256_primitive(void) {
+    return "sha256";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha256/ref/api.h

@@ -0,0 +1,9 @@
+
+#include "crypto_hashblocks_sha256.h"
+
+#define crypto_hashblocks crypto_hashblocks_sha256
+#define crypto_hashblocks_STATEBYTES crypto_hashblocks_sha256_STATEBYTES
+#define crypto_hashblocks_BLOCKBYTES crypto_hashblocks_sha256_BLOCKBYTES
+#define crypto_hashblocks_PRIMITIVE "sha256"
+#define crypto_hashblocks_IMPLEMENTATION crypto_hashblocks_sha256_IMPLEMENTATION
+#define crypto_hashblocks_VERSION crypto_hashblocks_sha256_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha256/ref/blocks_sha256.c

@@ -0,0 +1,212 @@
+#include "api.h"
+
+typedef unsigned int uint32;
+
+static uint32 load_bigendian(const unsigned char *x)
+{
+  return
+      (uint32) (x[3]) \
+  | (((uint32) (x[2])) << 8) \
+  | (((uint32) (x[1])) << 16) \
+  | (((uint32) (x[0])) << 24)
+  ;
+}
+
+static void store_bigendian(unsigned char *x,uint32 u)
+{
+  x[3] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[0] = u;
+}
+
+#define SHR(x,c) ((x) >> (c))
+#define ROTR(x,c) (((x) >> (c)) | ((x) << (32 - (c))))
+
+#define Ch(x,y,z) ((x & y) ^ (~x & z))
+#define Maj(x,y,z) ((x & y) ^ (x & z) ^ (y & z))
+#define Sigma0(x) (ROTR(x, 2) ^ ROTR(x,13) ^ ROTR(x,22))
+#define Sigma1(x) (ROTR(x, 6) ^ ROTR(x,11) ^ ROTR(x,25))
+#define sigma0(x) (ROTR(x, 7) ^ ROTR(x,18) ^ SHR(x, 3))
+#define sigma1(x) (ROTR(x,17) ^ ROTR(x,19) ^ SHR(x,10))
+
+#define M(w0,w14,w9,w1) w0 = sigma1(w14) + w9 + sigma0(w1) + w0;
+
+#define EXPAND \
+  M(w0 ,w14,w9 ,w1 ) \
+  M(w1 ,w15,w10,w2 ) \
+  M(w2 ,w0 ,w11,w3 ) \
+  M(w3 ,w1 ,w12,w4 ) \
+  M(w4 ,w2 ,w13,w5 ) \
+  M(w5 ,w3 ,w14,w6 ) \
+  M(w6 ,w4 ,w15,w7 ) \
+  M(w7 ,w5 ,w0 ,w8 ) \
+  M(w8 ,w6 ,w1 ,w9 ) \
+  M(w9 ,w7 ,w2 ,w10) \
+  M(w10,w8 ,w3 ,w11) \
+  M(w11,w9 ,w4 ,w12) \
+  M(w12,w10,w5 ,w13) \
+  M(w13,w11,w6 ,w14) \
+  M(w14,w12,w7 ,w15) \
+  M(w15,w13,w8 ,w0 )
+
+#define F(w,k) \
+  T1 = h + Sigma1(e) + Ch(e,f,g) + k + w; \
+  T2 = Sigma0(a) + Maj(a,b,c); \
+  h = g; \
+  g = f; \
+  f = e; \
+  e = d + T1; \
+  d = c; \
+  c = b; \
+  b = a; \
+  a = T1 + T2;
+
+int crypto_hashblocks(unsigned char *statebytes,const unsigned char *in,unsigned long long inlen)
+{
+  uint32 state[8];
+  uint32 a;
+  uint32 b;
+  uint32 c;
+  uint32 d;
+  uint32 e;
+  uint32 f;
+  uint32 g;
+  uint32 h;
+  uint32 T1;
+  uint32 T2;
+
+  a = load_bigendian(statebytes +  0); state[0] = a;
+  b = load_bigendian(statebytes +  4); state[1] = b;
+  c = load_bigendian(statebytes +  8); state[2] = c;
+  d = load_bigendian(statebytes + 12); state[3] = d;
+  e = load_bigendian(statebytes + 16); state[4] = e;
+  f = load_bigendian(statebytes + 20); state[5] = f;
+  g = load_bigendian(statebytes + 24); state[6] = g;
+  h = load_bigendian(statebytes + 28); state[7] = h;
+
+  while (inlen >= 64) {
+    uint32 w0  = load_bigendian(in +  0);
+    uint32 w1  = load_bigendian(in +  4);
+    uint32 w2  = load_bigendian(in +  8);
+    uint32 w3  = load_bigendian(in + 12);
+    uint32 w4  = load_bigendian(in + 16);
+    uint32 w5  = load_bigendian(in + 20);
+    uint32 w6  = load_bigendian(in + 24);
+    uint32 w7  = load_bigendian(in + 28);
+    uint32 w8  = load_bigendian(in + 32);
+    uint32 w9  = load_bigendian(in + 36);
+    uint32 w10 = load_bigendian(in + 40);
+    uint32 w11 = load_bigendian(in + 44);
+    uint32 w12 = load_bigendian(in + 48);
+    uint32 w13 = load_bigendian(in + 52);
+    uint32 w14 = load_bigendian(in + 56);
+    uint32 w15 = load_bigendian(in + 60);
+
+    F(w0 ,0x428a2f98)
+    F(w1 ,0x71374491)
+    F(w2 ,0xb5c0fbcf)
+    F(w3 ,0xe9b5dba5)
+    F(w4 ,0x3956c25b)
+    F(w5 ,0x59f111f1)
+    F(w6 ,0x923f82a4)
+    F(w7 ,0xab1c5ed5)
+    F(w8 ,0xd807aa98)
+    F(w9 ,0x12835b01)
+    F(w10,0x243185be)
+    F(w11,0x550c7dc3)
+    F(w12,0x72be5d74)
+    F(w13,0x80deb1fe)
+    F(w14,0x9bdc06a7)
+    F(w15,0xc19bf174)
+
+    EXPAND
+
+    F(w0 ,0xe49b69c1)
+    F(w1 ,0xefbe4786)
+    F(w2 ,0x0fc19dc6)
+    F(w3 ,0x240ca1cc)
+    F(w4 ,0x2de92c6f)
+    F(w5 ,0x4a7484aa)
+    F(w6 ,0x5cb0a9dc)
+    F(w7 ,0x76f988da)
+    F(w8 ,0x983e5152)
+    F(w9 ,0xa831c66d)
+    F(w10,0xb00327c8)
+    F(w11,0xbf597fc7)
+    F(w12,0xc6e00bf3)
+    F(w13,0xd5a79147)
+    F(w14,0x06ca6351)
+    F(w15,0x14292967)
+
+    EXPAND
+
+    F(w0 ,0x27b70a85)
+    F(w1 ,0x2e1b2138)
+    F(w2 ,0x4d2c6dfc)
+    F(w3 ,0x53380d13)
+    F(w4 ,0x650a7354)
+    F(w5 ,0x766a0abb)
+    F(w6 ,0x81c2c92e)
+    F(w7 ,0x92722c85)
+    F(w8 ,0xa2bfe8a1)
+    F(w9 ,0xa81a664b)
+    F(w10,0xc24b8b70)
+    F(w11,0xc76c51a3)
+    F(w12,0xd192e819)
+    F(w13,0xd6990624)
+    F(w14,0xf40e3585)
+    F(w15,0x106aa070)
+
+    EXPAND
+
+    F(w0 ,0x19a4c116)
+    F(w1 ,0x1e376c08)
+    F(w2 ,0x2748774c)
+    F(w3 ,0x34b0bcb5)
+    F(w4 ,0x391c0cb3)
+    F(w5 ,0x4ed8aa4a)
+    F(w6 ,0x5b9cca4f)
+    F(w7 ,0x682e6ff3)
+    F(w8 ,0x748f82ee)
+    F(w9 ,0x78a5636f)
+    F(w10,0x84c87814)
+    F(w11,0x8cc70208)
+    F(w12,0x90befffa)
+    F(w13,0xa4506ceb)
+    F(w14,0xbef9a3f7)
+    F(w15,0xc67178f2)
+
+    a += state[0];
+    b += state[1];
+    c += state[2];
+    d += state[3];
+    e += state[4];
+    f += state[5];
+    g += state[6];
+    h += state[7];
+
+    state[0] = a;
+    state[1] = b;
+    state[2] = c;
+    state[3] = d;
+    state[4] = e;
+    state[5] = f;
+    state[6] = g;
+    state[7] = h;
+
+    in += 64;
+    inlen -= 64;
+  }
+
+  store_bigendian(statebytes +  0,state[0]);
+  store_bigendian(statebytes +  4,state[1]);
+  store_bigendian(statebytes +  8,state[2]);
+  store_bigendian(statebytes + 12,state[3]);
+  store_bigendian(statebytes + 16,state[4]);
+  store_bigendian(statebytes + 20,state[5]);
+  store_bigendian(statebytes + 24,state[6]);
+  store_bigendian(statebytes + 28,state[7]);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha512/hashblocks_sha512_api.c

@@ -0,0 +1,16 @@
+#include "crypto_hashblocks_sha512.h"
+
+size_t
+crypto_hashblocks_sha512_statebytes(void) {
+    return crypto_hashblocks_sha512_STATEBYTES;
+}
+
+size_t
+crypto_hashblocks_sha512_blockbytes(void) {
+    return crypto_hashblocks_sha512_BLOCKBYTES;
+}
+
+const char *
+crypto_hashblocks_sha512_primitive(void) {
+    return "sha512";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha512/ref/api.h

@@ -0,0 +1,9 @@
+
+#include "crypto_hashblocks_sha512.h"
+
+#define crypto_hashblocks crypto_hashblocks_sha512
+#define crypto_hashblocks_STATEBYTES crypto_hashblocks_sha512_STATEBYTES
+#define crypto_hashblocks_BLOCKBYTES crypto_hashblocks_sha512_BLOCKBYTES
+#define crypto_hashblocks_PRIMITIVE "sha512"
+#define crypto_hashblocks_IMPLEMENTATION crypto_hashblocks_sha512_IMPLEMENTATION
+#define crypto_hashblocks_VERSION crypto_hashblocks_sha512_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_hashblocks/sha512/ref/blocks_sha512.c

@@ -0,0 +1,239 @@
+#include "api.h"
+
+typedef unsigned long long uint64;
+
+static uint64 load_bigendian(const unsigned char *x)
+{
+  return
+      (uint64) (x[7]) \
+  | (((uint64) (x[6])) << 8) \
+  | (((uint64) (x[5])) << 16) \
+  | (((uint64) (x[4])) << 24) \
+  | (((uint64) (x[3])) << 32) \
+  | (((uint64) (x[2])) << 40) \
+  | (((uint64) (x[1])) << 48) \
+  | (((uint64) (x[0])) << 56)
+  ;
+}
+
+static void store_bigendian(unsigned char *x,uint64 u)
+{
+  x[7] = u; u >>= 8;
+  x[6] = u; u >>= 8;
+  x[5] = u; u >>= 8;
+  x[4] = u; u >>= 8;
+  x[3] = u; u >>= 8;
+  x[2] = u; u >>= 8;
+  x[1] = u; u >>= 8;
+  x[0] = u;
+}
+
+#define SHR(x,c) ((x) >> (c))
+#define ROTR(x,c) (((x) >> (c)) | ((x) << (64 - (c))))
+
+#define Ch(x,y,z) ((x & y) ^ (~x & z))
+#define Maj(x,y,z) ((x & y) ^ (x & z) ^ (y & z))
+#define Sigma0(x) (ROTR(x,28) ^ ROTR(x,34) ^ ROTR(x,39))
+#define Sigma1(x) (ROTR(x,14) ^ ROTR(x,18) ^ ROTR(x,41))
+#define sigma0(x) (ROTR(x, 1) ^ ROTR(x, 8) ^ SHR(x,7))
+#define sigma1(x) (ROTR(x,19) ^ ROTR(x,61) ^ SHR(x,6))
+
+#define M(w0,w14,w9,w1) w0 = sigma1(w14) + w9 + sigma0(w1) + w0;
+
+#define EXPAND \
+  M(w0 ,w14,w9 ,w1 ) \
+  M(w1 ,w15,w10,w2 ) \
+  M(w2 ,w0 ,w11,w3 ) \
+  M(w3 ,w1 ,w12,w4 ) \
+  M(w4 ,w2 ,w13,w5 ) \
+  M(w5 ,w3 ,w14,w6 ) \
+  M(w6 ,w4 ,w15,w7 ) \
+  M(w7 ,w5 ,w0 ,w8 ) \
+  M(w8 ,w6 ,w1 ,w9 ) \
+  M(w9 ,w7 ,w2 ,w10) \
+  M(w10,w8 ,w3 ,w11) \
+  M(w11,w9 ,w4 ,w12) \
+  M(w12,w10,w5 ,w13) \
+  M(w13,w11,w6 ,w14) \
+  M(w14,w12,w7 ,w15) \
+  M(w15,w13,w8 ,w0 )
+
+#define F(w,k) \
+  T1 = h + Sigma1(e) + Ch(e,f,g) + k + w; \
+  T2 = Sigma0(a) + Maj(a,b,c); \
+  h = g; \
+  g = f; \
+  f = e; \
+  e = d + T1; \
+  d = c; \
+  c = b; \
+  b = a; \
+  a = T1 + T2;
+
+int crypto_hashblocks(unsigned char *statebytes,const unsigned char *in,unsigned long long inlen)
+{
+  uint64 state[8];
+  uint64 a;
+  uint64 b;
+  uint64 c;
+  uint64 d;
+  uint64 e;
+  uint64 f;
+  uint64 g;
+  uint64 h;
+  uint64 T1;
+  uint64 T2;
+
+  a = load_bigendian(statebytes +  0); state[0] = a;
+  b = load_bigendian(statebytes +  8); state[1] = b;
+  c = load_bigendian(statebytes + 16); state[2] = c;
+  d = load_bigendian(statebytes + 24); state[3] = d;
+  e = load_bigendian(statebytes + 32); state[4] = e;
+  f = load_bigendian(statebytes + 40); state[5] = f;
+  g = load_bigendian(statebytes + 48); state[6] = g;
+  h = load_bigendian(statebytes + 56); state[7] = h;
+
+  while (inlen >= 128) {
+    uint64 w0  = load_bigendian(in +   0);
+    uint64 w1  = load_bigendian(in +   8);
+    uint64 w2  = load_bigendian(in +  16);
+    uint64 w3  = load_bigendian(in +  24);
+    uint64 w4  = load_bigendian(in +  32);
+    uint64 w5  = load_bigendian(in +  40);
+    uint64 w6  = load_bigendian(in +  48);
+    uint64 w7  = load_bigendian(in +  56);
+    uint64 w8  = load_bigendian(in +  64);
+    uint64 w9  = load_bigendian(in +  72);
+    uint64 w10 = load_bigendian(in +  80);
+    uint64 w11 = load_bigendian(in +  88);
+    uint64 w12 = load_bigendian(in +  96);
+    uint64 w13 = load_bigendian(in + 104);
+    uint64 w14 = load_bigendian(in + 112);
+    uint64 w15 = load_bigendian(in + 120);
+
+    F(w0 ,0x428a2f98d728ae22ULL)
+    F(w1 ,0x7137449123ef65cdULL)
+    F(w2 ,0xb5c0fbcfec4d3b2fULL)
+    F(w3 ,0xe9b5dba58189dbbcULL)
+    F(w4 ,0x3956c25bf348b538ULL)
+    F(w5 ,0x59f111f1b605d019ULL)
+    F(w6 ,0x923f82a4af194f9bULL)
+    F(w7 ,0xab1c5ed5da6d8118ULL)
+    F(w8 ,0xd807aa98a3030242ULL)
+    F(w9 ,0x12835b0145706fbeULL)
+    F(w10,0x243185be4ee4b28cULL)
+    F(w11,0x550c7dc3d5ffb4e2ULL)
+    F(w12,0x72be5d74f27b896fULL)
+    F(w13,0x80deb1fe3b1696b1ULL)
+    F(w14,0x9bdc06a725c71235ULL)
+    F(w15,0xc19bf174cf692694ULL)
+
+    EXPAND
+
+    F(w0 ,0xe49b69c19ef14ad2ULL)
+    F(w1 ,0xefbe4786384f25e3ULL)
+    F(w2 ,0x0fc19dc68b8cd5b5ULL)
+    F(w3 ,0x240ca1cc77ac9c65ULL)
+    F(w4 ,0x2de92c6f592b0275ULL)
+    F(w5 ,0x4a7484aa6ea6e483ULL)
+    F(w6 ,0x5cb0a9dcbd41fbd4ULL)
+    F(w7 ,0x76f988da831153b5ULL)
+    F(w8 ,0x983e5152ee66dfabULL)
+    F(w9 ,0xa831c66d2db43210ULL)
+    F(w10,0xb00327c898fb213fULL)
+    F(w11,0xbf597fc7beef0ee4ULL)
+    F(w12,0xc6e00bf33da88fc2ULL)
+    F(w13,0xd5a79147930aa725ULL)
+    F(w14,0x06ca6351e003826fULL)
+    F(w15,0x142929670a0e6e70ULL)
+
+    EXPAND
+
+    F(w0 ,0x27b70a8546d22ffcULL)
+    F(w1 ,0x2e1b21385c26c926ULL)
+    F(w2 ,0x4d2c6dfc5ac42aedULL)
+    F(w3 ,0x53380d139d95b3dfULL)
+    F(w4 ,0x650a73548baf63deULL)
+    F(w5 ,0x766a0abb3c77b2a8ULL)
+    F(w6 ,0x81c2c92e47edaee6ULL)
+    F(w7 ,0x92722c851482353bULL)
+    F(w8 ,0xa2bfe8a14cf10364ULL)
+    F(w9 ,0xa81a664bbc423001ULL)
+    F(w10,0xc24b8b70d0f89791ULL)
+    F(w11,0xc76c51a30654be30ULL)
+    F(w12,0xd192e819d6ef5218ULL)
+    F(w13,0xd69906245565a910ULL)
+    F(w14,0xf40e35855771202aULL)
+    F(w15,0x106aa07032bbd1b8ULL)
+
+    EXPAND
+
+    F(w0 ,0x19a4c116b8d2d0c8ULL)
+    F(w1 ,0x1e376c085141ab53ULL)
+    F(w2 ,0x2748774cdf8eeb99ULL)
+    F(w3 ,0x34b0bcb5e19b48a8ULL)
+    F(w4 ,0x391c0cb3c5c95a63ULL)
+    F(w5 ,0x4ed8aa4ae3418acbULL)
+    F(w6 ,0x5b9cca4f7763e373ULL)
+    F(w7 ,0x682e6ff3d6b2b8a3ULL)
+    F(w8 ,0x748f82ee5defb2fcULL)
+    F(w9 ,0x78a5636f43172f60ULL)
+    F(w10,0x84c87814a1f0ab72ULL)
+    F(w11,0x8cc702081a6439ecULL)
+    F(w12,0x90befffa23631e28ULL)
+    F(w13,0xa4506cebde82bde9ULL)
+    F(w14,0xbef9a3f7b2c67915ULL)
+    F(w15,0xc67178f2e372532bULL)
+
+    EXPAND
+
+    F(w0 ,0xca273eceea26619cULL)
+    F(w1 ,0xd186b8c721c0c207ULL)
+    F(w2 ,0xeada7dd6cde0eb1eULL)
+    F(w3 ,0xf57d4f7fee6ed178ULL)
+    F(w4 ,0x06f067aa72176fbaULL)
+    F(w5 ,0x0a637dc5a2c898a6ULL)
+    F(w6 ,0x113f9804bef90daeULL)
+    F(w7 ,0x1b710b35131c471bULL)
+    F(w8 ,0x28db77f523047d84ULL)
+    F(w9 ,0x32caab7b40c72493ULL)
+    F(w10,0x3c9ebe0a15c9bebcULL)
+    F(w11,0x431d67c49c100d4cULL)
+    F(w12,0x4cc5d4becb3e42b6ULL)
+    F(w13,0x597f299cfc657e2aULL)
+    F(w14,0x5fcb6fab3ad6faecULL)
+    F(w15,0x6c44198c4a475817ULL)
+
+    a += state[0];
+    b += state[1];
+    c += state[2];
+    d += state[3];
+    e += state[4];
+    f += state[5];
+    g += state[6];
+    h += state[7];
+
+    state[0] = a;
+    state[1] = b;
+    state[2] = c;
+    state[3] = d;
+    state[4] = e;
+    state[5] = f;
+    state[6] = g;
+    state[7] = h;
+
+    in += 128;
+    inlen -= 128;
+  }
+
+  store_bigendian(statebytes +  0,state[0]);
+  store_bigendian(statebytes +  8,state[1]);
+  store_bigendian(statebytes + 16,state[2]);
+  store_bigendian(statebytes + 24,state[3]);
+  store_bigendian(statebytes + 32,state[4]);
+  store_bigendian(statebytes + 40,state[5]);
+  store_bigendian(statebytes + 48,state[6]);
+  store_bigendian(statebytes + 56,state[7]);
+
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/crypto_onetimeauth.c

@@ -0,0 +1,34 @@
+
+#include "crypto_onetimeauth.h"
+
+size_t
+crypto_onetimeauth_bytes(void)
+{
+    return crypto_onetimeauth_BYTES;
+}
+
+size_t
+crypto_onetimeauth_keybytes(void)
+{
+    return crypto_onetimeauth_KEYBYTES;
+}
+
+const char *
+crypto_onetimeauth_primitive(void)
+{
+    return crypto_onetimeauth_PRIMITIVE;
+}
+
+int
+crypto_onetimeauth(unsigned char *out, const unsigned char *in,
+                   unsigned long long inlen, const unsigned char *k)
+{
+    return crypto_onetimeauth_poly1305(out, in, inlen, k);
+}
+
+int
+crypto_onetimeauth_verify(const unsigned char *h, const unsigned char *in,
+                          unsigned long long inlen, const unsigned char *k)
+{
+    return crypto_onetimeauth_poly1305_verify(h, in, inlen, k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/53/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_onetimeauth_poly1305.h"
+
+#define crypto_onetimeauth_poly1305_implementation_name \
+    crypto_onetimeauth_poly1305_53_implementation_name
+
+#define crypto_onetimeauth crypto_onetimeauth_poly1305_53
+#define crypto_onetimeauth_verify crypto_onetimeauth_poly1305_53_verify

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/53/verify_poly1305_53.c

@@ -0,0 +1,10 @@
+#include "api.h"
+#include "crypto_onetimeauth_poly1305_53.h"
+#include "crypto_verify_16.h"
+
+int crypto_onetimeauth_verify(const unsigned char *h,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char correct[16];
+  crypto_onetimeauth(correct,in,inlen,k);
+  return crypto_verify_16(h,correct);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/donna/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_onetimeauth_poly1305.h"
+
+#define crypto_onetimeauth_poly1305_implementation_name \
+    crypto_onetimeauth_poly1305_donna_implementation_name
+
+#define crypto_onetimeauth crypto_onetimeauth_poly1305_donna
+#define crypto_onetimeauth_verify crypto_onetimeauth_poly1305_donna_verify

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/donna/auth_poly1305_donna.c

@@ -0,0 +1,151 @@
+
+#include "api.h"
+#include "crypto_onetimeauth_poly1305_donna.h"
+#include "utils.h"
+
+#include "portable-jane.h"
+
+int
+crypto_onetimeauth(unsigned char *out, const unsigned char *m,
+                   unsigned long long inlen, const unsigned char *key)
+{
+	uint32_t t0,t1,t2,t3;
+	uint32_t h0,h1,h2,h3,h4;
+	uint32_t r0,r1,r2,r3,r4;
+	uint32_t s1,s2,s3,s4;
+	uint32_t b, nb;
+	unsigned long long j;
+	uint64_t t[5];
+	uint64_t f0,f1,f2,f3;
+	uint32_t g0,g1,g2,g3,g4;
+	uint64_t c;
+	unsigned char mp[16];
+
+	/* clamp key */
+	t0 = U8TO32_LE(key+0);
+	t1 = U8TO32_LE(key+4);
+	t2 = U8TO32_LE(key+8);
+	t3 = U8TO32_LE(key+12);
+
+	/* precompute multipliers */
+	r0 = t0 & 0x3ffffff; t0 >>= 26; t0 |= t1 << 6;
+	r1 = t0 & 0x3ffff03; t1 >>= 20; t1 |= t2 << 12;
+	r2 = t1 & 0x3ffc0ff; t2 >>= 14; t2 |= t3 << 18;
+	r3 = t2 & 0x3f03fff; t3 >>= 8;
+	r4 = t3 & 0x00fffff;
+
+	s1 = r1 * 5;
+	s2 = r2 * 5;
+	s3 = r3 * 5;
+	s4 = r4 * 5;
+
+	/* init state */
+	h0 = 0;
+	h1 = 0;
+	h2 = 0;
+	h3 = 0;
+	h4 = 0;
+
+	/* full blocks */
+	if (inlen < 16) goto poly1305_donna_atmost15bytes;
+poly1305_donna_16bytes:
+	m += 16;
+	inlen -= 16;
+
+	t0 = U8TO32_LE(m-16);
+	t1 = U8TO32_LE(m-12);
+	t2 = U8TO32_LE(m-8);
+	t3 = U8TO32_LE(m-4);
+
+	h0 += t0 & 0x3ffffff;
+	h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
+	h2 += ((((uint64_t)t2 << 32) | t1) >> 20) & 0x3ffffff;
+	h3 += ((((uint64_t)t3 << 32) | t2) >> 14) & 0x3ffffff;
+	h4 += (t3 >> 8) | (1 << 24);
+
+
+poly1305_donna_mul:
+	t[0]  = mul32x32_64(h0,r0) + mul32x32_64(h1,s4) + mul32x32_64(h2,s3) + mul32x32_64(h3,s2) + mul32x32_64(h4,s1);
+	t[1]  = mul32x32_64(h0,r1) + mul32x32_64(h1,r0) + mul32x32_64(h2,s4) + mul32x32_64(h3,s3) + mul32x32_64(h4,s2);
+	t[2]  = mul32x32_64(h0,r2) + mul32x32_64(h1,r1) + mul32x32_64(h2,r0) + mul32x32_64(h3,s4) + mul32x32_64(h4,s3);
+	t[3]  = mul32x32_64(h0,r3) + mul32x32_64(h1,r2) + mul32x32_64(h2,r1) + mul32x32_64(h3,r0) + mul32x32_64(h4,s4);
+	t[4]  = mul32x32_64(h0,r4) + mul32x32_64(h1,r3) + mul32x32_64(h2,r2) + mul32x32_64(h3,r1) + mul32x32_64(h4,r0);
+
+	                h0 = (uint32_t)t[0] & 0x3ffffff; c =           (t[0] >> 26);
+	t[1] += c;      h1 = (uint32_t)t[1] & 0x3ffffff; b = (uint32_t)(t[1] >> 26);
+	t[2] += b;      h2 = (uint32_t)t[2] & 0x3ffffff; b = (uint32_t)(t[2] >> 26);
+	t[3] += b;      h3 = (uint32_t)t[3] & 0x3ffffff; b = (uint32_t)(t[3] >> 26);
+	t[4] += b;      h4 = (uint32_t)t[4] & 0x3ffffff; b = (uint32_t)(t[4] >> 26);
+	h0 += b * 5;
+
+	if (inlen >= 16) goto poly1305_donna_16bytes;
+
+	/* final bytes */
+poly1305_donna_atmost15bytes:
+	if (!inlen) goto poly1305_donna_finish;
+
+	for (j = 0; j < inlen; j++) mp[j] = m[j];
+	mp[j++] = 1;
+	for (; j < 16; j++)	mp[j] = 0;
+	inlen = 0;
+
+	t0 = U8TO32_LE(mp+0);
+	t1 = U8TO32_LE(mp+4);
+	t2 = U8TO32_LE(mp+8);
+	t3 = U8TO32_LE(mp+12);
+
+	h0 += t0 & 0x3ffffff;
+	h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
+	h2 += ((((uint64_t)t2 << 32) | t1) >> 20) & 0x3ffffff;
+	h3 += ((((uint64_t)t3 << 32) | t2) >> 14) & 0x3ffffff;
+	h4 += (t3 >> 8);
+
+	goto poly1305_donna_mul;
+
+poly1305_donna_finish:
+	             b = h0 >> 26; h0 = h0 & 0x3ffffff;
+	h1 +=     b; b = h1 >> 26; h1 = h1 & 0x3ffffff;
+	h2 +=     b; b = h2 >> 26; h2 = h2 & 0x3ffffff;
+	h3 +=     b; b = h3 >> 26; h3 = h3 & 0x3ffffff;
+	h4 +=     b; b = h4 >> 26; h4 = h4 & 0x3ffffff;
+	h0 += b * 5;
+
+	g0 = h0 + 5; b = g0 >> 26; g0 &= 0x3ffffff;
+	g1 = h1 + b; b = g1 >> 26; g1 &= 0x3ffffff;
+	g2 = h2 + b; b = g2 >> 26; g2 &= 0x3ffffff;
+	g3 = h3 + b; b = g3 >> 26; g3 &= 0x3ffffff;
+	g4 = h4 + b - (1 << 26);
+
+	b = (g4 >> 31) - 1;
+	nb = ~b;
+	h0 = (h0 & nb) | (g0 & b);
+	h1 = (h1 & nb) | (g1 & b);
+	h2 = (h2 & nb) | (g2 & b);
+	h3 = (h3 & nb) | (g3 & b);
+	h4 = (h4 & nb) | (g4 & b);
+
+	f0 = ((h0      ) | (h1 << 26)) + (uint64_t)U8TO32_LE(&key[16]);
+	f1 = ((h1 >>  6) | (h2 << 20)) + (uint64_t)U8TO32_LE(&key[20]);
+	f2 = ((h2 >> 12) | (h3 << 14)) + (uint64_t)U8TO32_LE(&key[24]);
+	f3 = ((h3 >> 18) | (h4 <<  8)) + (uint64_t)U8TO32_LE(&key[28]);
+
+	U32TO8_LE(&out[ 0], f0); f1 += (f0 >> 32);
+	U32TO8_LE(&out[ 4], f1); f2 += (f1 >> 32);
+	U32TO8_LE(&out[ 8], f2); f3 += (f2 >> 32);
+	U32TO8_LE(&out[12], f3);
+
+    return 0;
+}
+
+const char *
+crypto_onetimeauth_poly1305_implementation_name(void)
+{
+    return "donna";
+}
+
+struct crypto_onetimeauth_poly1305_implementation
+crypto_onetimeauth_poly1305_donna_implementation = {
+    _SODIUM_C99(.implementation_name =) crypto_onetimeauth_poly1305_implementation_name,
+    _SODIUM_C99(.onetimeauth =) crypto_onetimeauth,
+    _SODIUM_C99(.onetimeauth_verify =) crypto_onetimeauth_verify
+};

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/donna/portable-jane.h

@@ -0,0 +1,772 @@
+#ifndef PORTABLE_JANE_H
+#define PORTABLE_JANE_H "+endian +uint128"
+/* 0000-os-100-solaris.h */
+
+#if defined(sun) || defined(__sun) || defined(__SVR4) || defined(__svr4__)
+	#include <sys/mman.h>
+	#include <sys/time.h>
+	#include <fcntl.h>
+
+	#define OS_SOLARIS
+#endif
+
+/* 0000-os-100-unix.h */
+
+#if defined(__unix__) || defined(unix)
+	#include <sys/mman.h>
+	#include <sys/time.h>
+	#if !defined(USG)
+		#include <sys/param.h> /* need this to define BSD */
+	#endif
+	#include <unistd.h>
+	#include <fcntl.h>
+
+	#define OS_NIX
+	#if defined(__linux__)
+		#include <endian.h>
+		#define OS_LINUX
+	#elif defined(BSD)
+		#define OS_BSD
+
+		#if defined(MACOS_X) || (defined(__APPLE__) & defined(__MACH__))
+			#define OS_OSX
+		#elif defined(macintosh) || defined(Macintosh)
+			#define OS_MAC
+		#elif defined(__OpenBSD__)
+			#define OS_OPENBSD
+		#elif defined(__FreeBSD__)
+			#define OS_FREEBSD
+		#elif defined(__NetBSD__)
+			#define OS_NETBSD
+		#endif
+	#endif
+#endif
+
+/* 0000-os-100-windows.h */
+
+#if defined(_WIN32)	|| defined(_WIN64) || defined(__TOS_WIN__) || defined(__WINDOWS__)
+	#include <windows.h>
+	#include <wincrypt.h>
+	#define OS_WINDOWS
+#endif
+
+/* 0100-compiler-000.h */
+
+#undef NOINLINE
+#undef INLINE
+#undef FASTCALL
+#undef CDECL
+#undef STDCALL
+#undef NAKED
+
+/* 0100-compiler-100-clang.h */
+
+#if defined(__clang__)
+	#define COMPILER_CLANG ((__clang_major__ * 10000) + (__clang_minor__ * 100) + (__clang_patchlevel__))
+#endif
+
+/* 0100-compiler-100-gcc.h */
+
+#if defined(__GNUC__)
+	#if (__GNUC__ >= 3)
+		#define COMPILER_GCC_PATCHLEVEL __GNUC_PATCHLEVEL__
+	#else
+		#define COMPILER_GCC_PATCHLEVEL 0
+	#endif
+	#define COMPILER_GCC ((__GNUC__ * 10000) + (__GNUC_MINOR__ * 100) + (COMPILER_GCC_PATCHLEVEL))
+
+	#include <stdint.h>
+
+	typedef unsigned int fpu_control_t;
+
+	#define ROTL32(a,b) (((a) << (b)) | ((a) >> (32 - b)))
+	#define ROTR32(a,b) (((a) >> (b)) | ((a) << (32 - b)))
+	#define ROTL64(a,b) (((a) << (b)) | ((a) >> (64 - b)))
+	#define ROTR64(a,b) (((a) >> (b)) | ((a) << (64 - b)))
+
+	#if (COMPILER_GCC >= 30000)
+		#define NOINLINE __attribute__((noinline))
+	#else
+		#define NOINLINE
+	#endif
+	#if (COMPILER_GCC >= 30000)
+		#define INLINE inline __attribute__((always_inline))
+	#else
+		#define INLINE inline
+	#endif
+	#if (COMPILER_GCC >= 30400)
+		#define FASTCALL __attribute__((fastcall))
+	#else
+		#define FASTCALL
+	#endif
+	#define CDECL __attribute__((cdecl))
+	#define STDCALL __attribute__((stdcall))
+
+	#define mul32x32_64(a,b) ((uint64_t)(a) * (b))
+	#define mul32x32_64s(a,b) (((int64_t)(a))*(b))
+#endif
+
+/* 0100-compiler-100-icc.h */
+
+#if defined(__ICC)
+	#define COMPILER_ICC __ICC
+#endif
+
+/* 0100-compiler-100-mingw.h */
+
+#if defined(__MINGW32__) || defined(__MINGW64__)
+	#define COMPILER_MINGW
+#endif
+
+/* 0100-compiler-100-msvc.h */
+
+#if defined(_MSC_VER)
+#ifndef _CRT_SECURE_NO_WARNINGS
+# define _CRT_SECURE_NO_WARNINGS
+#endif
+
+	#pragma warning(disable : 4127) /* conditional expression is constant */
+	#pragma warning(disable : 4100) /* unreferenced formal parameter */
+
+	#include <float.h>
+	#include <stdlib.h> /* _rotl */
+	#include <intrin.h>
+
+	#define COMPILER_MSVC_VS6       120000000
+	#define COMPILER_MSVC_VS6PP     121000000
+	#define COMPILER_MSVC_VS2002    130000000
+	#define COMPILER_MSVC_VS2003    131000000
+	#define COMPILER_MSVC_VS2005    140050727
+	#define COMPILER_MSVC_VS2008    150000000
+	#define COMPILER_MSVC_VS2008SP1 150030729
+	#define COMPILER_MSVC_VS2010    160000000
+	#define COMPILER_MSVC_VS2010SP1 160040219
+	#define COMPILER_MSVC_VS2012RC  170000000
+	#define COMPILER_MSVC_VS2012    170050727
+
+	#if _MSC_FULL_VER > 100000000
+		#define COMPILER_MSVC (_MSC_FULL_VER)
+	#else
+		#define COMPILER_MSVC (_MSC_FULL_VER * 10)
+	#endif
+
+	#if ((_MSC_VER == 1200) && defined(_mm_free))
+		#undef COMPILER_MSVC
+		#define COMPILER_MSVC COMPILER_MSVC_VS6PP
+	#endif
+
+	typedef unsigned char uint8_t;
+	typedef unsigned short uint16_t;
+	typedef unsigned int uint32_t;
+	typedef signed int int32_t;
+	typedef unsigned __int64 uint64_t;
+	typedef signed __int64 int64_t;
+
+	typedef uint16_t fpu_control_t;
+
+	#define ROTL32(a,b) _rotl(a,b)
+	#define ROTR32(a,b) _rotr(a,b)
+	#define ROTL64(a,b) _rotl64(a,b)
+	#define ROTR64(a,b) _rotr64(a,b)
+
+	#define NOINLINE __declspec(noinline)
+	#define INLINE __forceinline
+	#define FASTCALL __fastcall
+	#define CDECL __cdecl
+	#define STDCALL __stdcall
+	#define NAKED __declspec(naked)
+
+	#if defined(_DEBUG)
+		#define mul32x32_64(a,b) (((uint64_t)(a))*(b))
+		#define mul32x32_64s(a,b) (((int64_t)(a))*(b))
+	#else
+		#define mul32x32_64(a,b) __emulu(a,b)
+		#define mul32x32_64s(a,b) __emul(a,b)
+	#endif
+#endif
+/* 0100-compiler-999.h */
+
+#define OPTIONAL_INLINE /* config */
+#if defined(OPTIONAL_INLINE)
+	#undef OPTIONAL_INLINE
+	#define OPTIONAL_INLINE INLINE
+#else
+	#define OPTIONAL_INLINE
+#endif
+
+#define Preprocessor_ToString(s) #s
+#define Stringify(s) Preprocessor_ToString(s)
+
+#include <stdio.h>
+#include <string.h>
+
+/* 0200-cpu-100-alpha.h */
+
+#if defined(__alpha__) || defined(__alpha) || defined(_M_ALPHA)
+	#define CPU_ALPHA
+#endif
+
+/* 0200-cpu-100-hppa.h */
+
+#if defined(__hppa__) || defined(__hppa)
+	#define CPU_HPPA
+#endif
+
+/* 0200-cpu-100-intel.h */
+
+#if defined(__amd64__) || defined(__amd64) || defined(__x86_64__ ) || defined(_M_X64)
+	#define CPU_X86_64
+#elif defined(__i586__) || defined(__i686__) || (defined(_M_IX86) && (_M_IX86 >= 500))
+	#define CPU_X86 500
+#elif defined(__i486__) || (defined(_M_IX86) && (_M_IX86 >= 400))
+	#define CPU_X86 400
+#elif defined(__i386__) || (defined(_M_IX86) && (_M_IX86 >= 300)) || defined(__X86__) || defined(_X86_) || defined(__I86__)
+	#define CPU_X86 300
+#elif defined(__ia64__) || defined(_IA64) || defined(__IA64__) || defined(_M_IA64) || defined(__ia64)
+	#define CPU_IA64
+#endif
+
+/* 0200-cpu-100-ppc.h */
+
+#if defined(powerpc) || defined(__PPC__) || defined(__ppc__) || defined(_ARCH_PPC) || defined(__powerpc__) || defined(__powerpc) || defined(POWERPC) || defined(_M_PPC)
+	#define CPU_PPC
+	#if defined(_ARCH_PWR7)
+		#define CPU_POWER7
+	#elif defined(__64BIT__)
+		#define CPU_PPC64
+	#else
+		#define CPU_PPC32
+	#endif
+#endif
+
+/* 0200-cpu-100-sparc.h */
+
+#if defined(__sparc__) || defined(__sparc) || defined(__sparcv9)
+	#define CPU_SPARC
+	#if defined(__sparcv9)
+		#define CPU_SPARC64
+	#else
+		#define CPU_SPARC32
+	#endif
+#endif
+
+/* 0200-cpu-200-bits.h */
+
+#if defined(CPU_X86_64) || defined(CPU_IA64) || defined(CPU_SPARC64) || defined(__64BIT__) || defined(__LP64__) || defined(_LP64) || (defined(_MIPS_SZLONG) && (_MIPS_SZLONG == 64))
+	#define CPU_64BITS
+
+	#undef FASTCALL
+	#undef CDECL
+	#undef STDCALL
+
+	#define FASTCALL
+	#define CDECL
+	#define STDCALL
+#endif
+
+/* 0200-cpu-200-endian.h */
+
+#if ((defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && (__BYTE_ORDER == __LITTLE_ENDIAN)) || \
+	 (defined(BYTE_ORDER) && defined(LITTLE_ENDIAN) && (BYTE_ORDER == LITTLE_ENDIAN)) || \
+	 (defined(CPU_X86) || defined(CPU_X86_64)) || \
+	 (defined(vax) || defined(MIPSEL) || defined(_MIPSEL)))
+#define CPU_LE
+#elif ((defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && (__BYTE_ORDER == __BIG_ENDIAN)) || \
+	   (defined(BYTE_ORDER) && defined(BIG_ENDIAN) && (BYTE_ORDER == BIG_ENDIAN)) || \
+	   (defined(CPU_SPARC) || defined(CPU_PPC) || defined(mc68000) || defined(sel)) || defined(_MIPSEB))
+#define CPU_BE
+#else
+	/* unknown endian! */
+#endif
+
+#if defined(__s390__) || defined(__zarch__) || defined(__SYSC_ZARCH__)
+# define CPU_Z390
+#endif
+
+/* 0400-endian-100-be.h */
+
+#if defined(CPU_BE) && !defined(CPU_ALIGNED_ACCESS_REQUIRED)
+	static INLINE uint16_t fU8TO16_BE_FAST(const uint8_t *p) { return *(const uint16_t *)p; }
+	static INLINE uint32_t fU8TO32_BE_FAST(const uint8_t *p) { return *(const uint32_t *)p; }
+	static INLINE uint64_t fU8TO64_BE_FAST(const uint8_t *p) {	return *(const uint64_t *)p; }
+	static INLINE void fU16TO8_BE_FAST(uint8_t *p, const uint16_t v) { *(uint16_t *)p = v; }
+	static INLINE void fU32TO8_BE_FAST(uint8_t *p, const uint32_t v) { *(uint32_t *)p = v; }
+	static INLINE void fU64TO8_BE_FAST(uint8_t *p, const uint64_t v) { *(uint64_t *)p = v; }
+
+	#define U8TO16_BE(p) fU8TO16_BE_FAST(p)
+	#define U8TO32_BE(p) fU8TO32_BE_FAST(p)
+	#define U8TO64_BE(p) fU8TO64_BE_FAST(p)
+	#define U16TO8_BE(p, v) fU16TO8_BE_FAST(p, v)
+	#define U32TO8_BE(p, v) fU32TO8_BE_FAST(p, v)
+	#define U64TO8_BE(p, v) fU64TO8_BE_FAST(p, v)
+#endif
+
+/* 0400-endian-100-le.h */
+
+#if defined(CPU_LE) && !defined(CPU_ALIGNED_ACCESS_REQUIRED)
+	static INLINE uint16_t fU8TO16_LE_FAST(const uint8_t *p) { return *(const uint16_t *)p; }
+	static INLINE uint32_t fU8TO32_LE_FAST(const uint8_t *p) { return *(const uint32_t *)p; }
+	static INLINE uint64_t fU8TO64_LE_FAST(const uint8_t *p) {	return *(const uint64_t *)p; }
+	static INLINE void fU16TO8_LE_FAST(uint8_t *p, const uint16_t v) { *(uint16_t *)p = v; }
+	static INLINE void fU32TO8_LE_FAST(uint8_t *p, const uint32_t v) { *(uint32_t *)p = v; }
+	static INLINE void fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) { *(uint64_t *)p = v; }
+
+	#define U8TO16_LE(p) fU8TO16_LE_FAST(p)
+	#define U8TO32_LE(p) fU8TO32_LE_FAST(p)
+	#define U8TO64_LE(p) fU8TO64_LE_FAST(p)
+	#define U16TO8_LE(p, v) fU16TO8_LE_FAST(p, v)
+	#define U32TO8_LE(p, v) fU32TO8_LE_FAST(p, v)
+	#define U64TO8_LE(p, v) fU64TO8_LE_FAST(p, v)
+#endif
+
+/* 0400-endian-100-ppc.h */
+
+#if defined(CPU_PPC)
+	#if defined(CPU_POWER7)
+		static INLINE uint64_t fU8TO64_LE_FAST(const uint8_t *p) {
+			uint64_d d;
+			__asm__ ("ldbrx %0,0,%1" : "=r"(d) : "r"(p))
+			return d;
+		}
+
+		static INLINE void
+		fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) {
+			__asm__ ("stdbrx %1,0,%0" : : "r"(p), "r"(v))
+		}
+	#elif defined(CPU_PPC64)
+		static INLINE uint64_t
+		fU8TO64_LE_FAST(const uint8_t *p) {
+			uint64_t *s4, h, d;
+			__asm__ ("addi %0,%3,4;lwbrx %1,0,%3;lwbrx %2,0,%0;rldimi %1,%2,32,0" : "+r"(s4), "=r"(d), "=r"(h) : "b"(p));
+			return d;
+		}
+
+		static INLINE void
+		fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) {
+			uint64_t *s4, h = v >> 32;
+			__asm__ ("addi %0,%3,4;stwbrx %1,0,%3;stwbrx %2,0,%0" : "+r"(s4) : "r"(v), "r"(h), "b"(p));
+		}
+	#elif defined(CPU_PPC32)
+		static INLINE uint64_t
+		fU8TO64_LE_FAST(const uint8_t *p) {
+			uint32_t *s4, h, l;
+			__asm__ ("addi %0,%3,4;lwbrx %1,0,%3;lwbrx %2,0,%0" : "+r"(s4), "=r"(l), "=r"(h) : "b"(p));\
+			return ((uint64_t)h << 32) | l;
+		}
+
+		static INLINE void
+		fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) {
+			uint32_t *s4, h = (uint32_t)(v >> 32), l = (uint32_t)(v & (uint32_t)0xffffffff);
+			__asm__ ("addi %0,%3,4;stwbrx %1,0,%3;stwbrx %2,0,%0" : "+r"(s4) : "r"(l), "r"(h), "b"(p));
+		}
+	#endif
+
+	static INLINE uint32_t
+	fU8TO32_LE_FAST(const uint8_t *p) {
+		uint32_t d;
+		__asm__ ("lwbrx %0,0,%1" : "=r"(d) : "r"(p));
+		return d;
+	}
+
+	static INLINE void
+	fU32TO8_LE_FAST(uint8_t *p, const uint32_t v) {
+		__asm__ __volatile__("stwbrx %1,0,%0" : : "r"(p), "r"(v));
+	}
+
+	#define U8TO32_LE(p) fU8TO32_LE_FAST(p)
+	#define U8TO64_LE(p) fU8TO64_LE_FAST(p)
+	#define U32TO8_LE(p, v) fU32TO8_LE_FAST(p, v)
+	#define U64TO8_LE(p, v) fU64TO8_LE_FAST(p, v)
+#endif
+
+/* 0400-endian-100-sparc.h */
+
+#if defined(CPU_SPARC)
+	#if defined(CPU_SPARC64)
+		static INLINE uint64_t
+		fU8TO64_LE_FAST(const uint8_t *p) {
+			uint64_d d;
+			__asm__ ("ldxa [%1]0x88,%0" : "=r"(d) : "r"(p));
+			return d;
+		}
+
+		static INLINE void
+		fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) {
+			__asm__ ("stxa %0,[%1]0x88" : : "r"(v), "r"(p));
+		}
+	#else
+		static INLINE uint64_t
+		fU8TO64_LE_FAST(const uint8_t *p) {
+			uint32_t *s4, h, l;
+			__asm__ ("add %3,4,%0\n\tlda [%3]0x88,%1\n\tlda [%0]0x88,%2" : "+r"(s4), "=r"(l), "=r"(h) : "r"(p));
+			return ((uint64_t)h << 32) | l;
+		}
+
+		static INLINE void
+		fU64TO8_LE_FAST(uint8_t *p, const uint64_t v) {
+			uint32_t *s4, h = (uint32_t)(v >> 32), l = (uint32_t)(v & (uint32_t)0xffffffff);
+			__asm__ ("add %3,4,%0\n\tsta %1,[%3]0x88\n\tsta %2,[%0]0x88" : "+r"(s4) : "r"(l), "r"(h), "r"(p));
+		}
+	#endif
+
+	static INLINE uint32_t
+	fU8TO32_LE_FAST(const uint8_t *p) {
+		uint32_t d;
+		__asm__ ("lda [%1]0x88,%0" : "=r"(d) : "r"(p));
+		return d;
+	}
+
+	static INLINE void
+	fU32TO8_LE_FAST(uint8_t *p, const uint32_t v) {
+		__asm__ ("sta %0,[%1]0x88" : : "r"(p), "r"(v));
+	}
+
+	#define U8TO32_LE(p) fU8TO32_LE_FAST(p)
+	#define U8TO64_LE(p) fU8TO64_LE_FAST(p)
+	#define U32TO8_LE(p, v) fU32TO8_LE_FAST(p, v)
+	#define U64TO8_LE(p, v) fU64TO8_LE_FAST(p, v)
+#endif
+
+/* 0400-endian-100-x86.h */
+
+#if (((defined(CPU_X86) && (CPU_X86 >= 400)) || defined(CPU_X86_64)) && (defined(COMPILER_MSVC) || defined(COMPILER_GCC)))
+	#if defined(COMPILER_MSVC)
+		static INLINE uint16_t U16_SWAP_FAST(uint16_t v) { return _byteswap_ushort(v); }
+		static INLINE uint32_t U32_SWAP_FAST(uint32_t v) { return _byteswap_ulong(v); }
+		static INLINE uint64_t U64_SWAP_FAST(uint64_t v) { return _byteswap_uint64(v); }
+	#else
+		static INLINE uint16_t U16_SWAP_FAST(uint16_t v) { __asm__("rorw $8,%0" : "+r" (v)); return v; }
+		static INLINE uint32_t U32_SWAP_FAST(uint32_t v) { __asm__("bswap %0" : "+r" (v)); return v; }
+		#if defined(CPU_X86_64)
+			static INLINE uint64_t U64_SWAP_FAST(uint64_t v) { __asm__("bswap %0" : "+r" (v)); return v; }
+		#else
+			static INLINE uint64_t U64_SWAP_FAST(uint64_t v) { 
+				uint32_t lo = U32_SWAP_FAST((uint32_t)(v)), hi = U32_SWAP_FAST((uint32_t)(v >> 32));
+				return ((uint64_t)lo << 32) | hi;
+			}
+		#endif
+	#endif
+
+
+	static INLINE uint16_t fU8TO16_BE_FAST(const uint8_t *p) { return U16_SWAP_FAST(*(const uint16_t *)p); }
+	static INLINE uint32_t fU8TO32_BE_FAST(const uint8_t *p) { return U32_SWAP_FAST(*(const uint32_t *)p); }
+	static INLINE uint64_t fU8TO64_BE_FAST(const uint8_t *p) { return U64_SWAP_FAST(*(const uint64_t *)p); }
+	static INLINE void fU16TO8_BE_FAST(uint8_t *p, const uint16_t v) { *(uint16_t *)p = U16_SWAP_FAST(v); }
+	static INLINE void fU32TO8_BE_FAST(uint8_t *p, const uint32_t v) { *(uint32_t *)p = U32_SWAP_FAST(v); }
+	static INLINE void fU64TO8_BE_FAST(uint8_t *p, const uint64_t v) { *(uint64_t *)p = U64_SWAP_FAST(v); }
+
+	#define U16_SWAP(p) U16_SWAP_FAST(p)
+	#define U32_SWAP(p) U32_SWAP_FAST(p)
+	#define U64_SWAP(p) U64_SWAP_FAST(p)
+	#define U8TO16_BE(p) fU8TO16_BE_FAST(p)
+	#define U8TO32_BE(p) fU8TO32_BE_FAST(p)
+	#define U8TO64_BE(p) fU8TO64_BE_FAST(p)
+	#define U16TO8_BE(p, v) fU16TO8_BE_FAST(p, v)
+	#define U32TO8_BE(p, v) fU32TO8_BE_FAST(p, v)
+	#define U64TO8_BE(p, v) fU64TO8_BE_FAST(p, v)
+#endif
+
+/* 0400-endian-999-generic-be.h */
+
+#if !defined(U8TO16_BE)
+	static INLINE uint16_t
+	fU8TO16_BE_SLOW(const uint8_t *p) {
+		return
+		(((uint16_t)(p[0]) <<  8) |
+		 ((uint16_t)(p[1])      ));
+	}
+
+	#define U8TO16_BE(p) fU8TO16_BE_SLOW(p)
+#endif
+
+
+#if !defined(U8TO32_BE)
+	static INLINE uint32_t
+	fU8TO32_BE_SLOW(const uint8_t *p) {
+		return
+		(((uint32_t)(p[0]) << 24) |
+		 ((uint32_t)(p[1]) << 16) |
+		 ((uint32_t)(p[2]) <<  8) |
+		 ((uint32_t)(p[3])      ));
+	}
+
+	#define U8TO32_BE(p) fU8TO32_BE_SLOW(p)
+#endif
+
+#if !defined(U8TO64_BE)
+	static INLINE uint64_t
+	fU8TO64_BE_SLOW(const uint8_t *p) {
+		return
+		(((uint64_t)(p[0]) << 56) |
+		 ((uint64_t)(p[1]) << 48) |
+		 ((uint64_t)(p[2]) << 40) |
+		 ((uint64_t)(p[3]) << 32) |
+		 ((uint64_t)(p[4]) << 24) |
+		 ((uint64_t)(p[5]) << 16) |
+		 ((uint64_t)(p[6]) <<  8) |
+		 ((uint64_t)(p[7])      ));
+	}
+
+	#define U8TO64_BE(p) fU8TO64_BE_SLOW(p)
+#endif
+
+#if !defined(U16TO8_BE)
+	static INLINE void
+	fU16TO8_BE_SLOW(uint8_t *p, const uint16_t v) {
+		p[0] = (uint8_t)(v >>  8);
+		p[1] = (uint8_t)(v      );
+	}
+
+	#define U16TO8_BE(p, v) fU16TO8_BE_SLOW(p, v)
+#endif
+
+#if !defined(U32TO8_BE)
+	static INLINE void
+	fU32TO8_BE_SLOW(uint8_t *p, const uint32_t v) {
+		p[0] = (uint8_t)(v >> 24);
+		p[1] = (uint8_t)(v >> 16);
+		p[2] = (uint8_t)(v >>  8);
+		p[3] = (uint8_t)(v      );
+	}
+
+	#define U32TO8_BE(p, v) fU32TO8_BE_SLOW(p, v)
+#endif
+
+#if !defined(U64TO8_BE)
+	static INLINE void
+	fU64TO8_BE_SLOW(uint8_t *p, const uint64_t v) {
+		p[0] = (uint8_t)(v >> 56);
+		p[1] = (uint8_t)(v >> 48);
+		p[2] = (uint8_t)(v >> 40);
+		p[3] = (uint8_t)(v >> 32);
+		p[4] = (uint8_t)(v >> 24);
+		p[5] = (uint8_t)(v >> 16);
+		p[6] = (uint8_t)(v >>  8);
+		p[7] = (uint8_t)(v      );
+	}
+
+	#define U64TO8_BE(p, v) fU64TO8_BE_SLOW(p, v)
+#endif
+
+/* 0400-endian-999-generic-le.h */
+
+#if !defined(U8TO16_LE)
+	static INLINE uint16_t
+	fU8TO16_LE_SLOW(const uint8_t *p) {
+		return
+		(((uint16_t)(p[0])      ) |
+		 ((uint16_t)(p[1]) <<  8));
+	}
+
+	#define U8TO16_LE(p) fU8TO16_LE_SLOW(p)
+#endif
+
+#if !defined(U8TO32_LE)
+	static INLINE uint32_t
+	fU8TO32_LE_SLOW(const uint8_t *p) {
+		return
+		(((uint32_t)(p[0])      ) |
+		 ((uint32_t)(p[1]) <<  8) |
+		 ((uint32_t)(p[2]) << 16) |
+		 ((uint32_t)(p[3]) << 24));
+	}
+
+	#define U8TO32_LE(p) fU8TO32_LE_SLOW(p)
+#endif
+
+
+#if !defined(U8TO64_LE)
+	static INLINE uint64_t
+	fU8TO64_LE_SLOW(const uint8_t *p) {
+		return
+		(((uint64_t)(p[0])      ) |
+		 ((uint64_t)(p[1]) <<  8) |
+		 ((uint64_t)(p[2]) << 16) |
+		 ((uint64_t)(p[3]) << 24) |
+		 ((uint64_t)(p[4]) << 32) |
+		 ((uint64_t)(p[5]) << 40) |
+		 ((uint64_t)(p[6]) << 48) |
+		 ((uint64_t)(p[7]) << 56));
+	}
+
+	#define U8TO64_LE(p) fU8TO64_LE_SLOW(p)
+#endif
+
+#if !defined(U16TO8_LE)
+	static INLINE void
+	fU16TO8_LE_SLOW(uint8_t *p, const uint16_t v) {
+		p[0] = (uint8_t)(v      );
+		p[1] = (uint8_t)(v >>  8);
+	}
+
+	#define U16TO8_LE(p, v) fU16TO8_LE_SLOW(p, v)
+#endif
+
+#if !defined(U32TO8_LE)
+	static INLINE void
+	fU32TO8_LE_SLOW(uint8_t *p, const uint32_t v) {
+		p[0] = (uint8_t)(v      );
+		p[1] = (uint8_t)(v >>  8);
+		p[2] = (uint8_t)(v >> 16);
+		p[3] = (uint8_t)(v >> 24);
+	}
+
+	#define U32TO8_LE(p, v) fU32TO8_LE_SLOW(p, v)
+#endif
+
+#if !defined(U64TO8_LE)
+	static INLINE void
+	fU64TO8_LE_SLOW(uint8_t *p, const uint64_t v) {
+		p[0] = (uint8_t)(v      );
+		p[1] = (uint8_t)(v >>  8);
+		p[2] = (uint8_t)(v >> 16);
+		p[3] = (uint8_t)(v >> 24);
+		p[4] = (uint8_t)(v >> 32);
+		p[5] = (uint8_t)(v >> 40);
+		p[6] = (uint8_t)(v >> 48);
+		p[7] = (uint8_t)(v >> 56);
+	}
+
+	#define U64TO8_LE(p, v) fU64TO8_LE_SLOW(p, v)
+#endif
+
+/* 0400-endian-999-generic-swap.h */
+
+#if !defined(U16_SWAP)
+	static INLINE uint16_t
+	fU16_SWAP_SLOW(uint16_t v) {
+	    v = (v << 8) | (v >> 8);
+	    return v;
+	}
+
+	#define U16_SWAP(p) fU16_SWAP_SLOW(p)
+#endif
+
+#if !defined(U32_SWAP)
+	static INLINE uint32_t
+	fU32_SWAP_SLOW(uint32_t v) {
+		v = ((v << 8) & 0xFF00FF00) | ((v >> 8) & 0xFF00FF);
+	    v = (v << 16) | (v >> 16);
+	    return v;
+	}
+
+	#define U32_SWAP(p) fU32_SWAP_SLOW(p)
+#endif
+
+#if !defined(U64_SWAP)
+	static INLINE uint64_t
+	fU64_SWAP_SLOW(uint64_t v) {
+		v = ((v <<  8) & 0xFF00FF00FF00FF00ull) | ((v >>  8) & 0x00FF00FF00FF00FFull);
+		v = ((v << 16) & 0xFFFF0000FFFF0000ull) | ((v >> 16) & 0x0000FFFF0000FFFFull);
+	    v = (v << 32) | (v >> 32);
+	    return v;
+	}
+
+	#define U64_SWAP(p) fU64_SWAP_SLOW(p)
+#endif
+
+/* 0400-uint128-000.h */
+
+/* 0400-uint128-100-clang.h */
+
+#ifdef HAVE_TI_MODE
+# define HAVE_NATIVE_UINT128
+typedef unsigned uint128_t __attribute__((mode(TI)));
+#endif
+
+/* 0400-uint128-100-msvc.h */
+
+#if defined(CPU_64BITS) && defined(COMPILER_MSVC)
+	#define HAVE_UINT128
+
+	typedef struct uint128 {
+		uint64_t lo, hi;
+	} uint128_t;
+
+	static INLINE uint128_t
+	mul64x64_128(uint64_t a, uint64_t b) {
+		uint128_t v;
+		v.lo = _umul128(a, b, &v.hi);
+		return v;
+	}
+
+	static INLINE uint64_t
+	shr128_pair(uint64_t hi, uint64_t lo, const int shift) {
+		return __shiftright128(lo, hi, shift);
+	}
+
+	static INLINE uint64_t
+	shr128(uint128_t v, const int shift) {
+		return __shiftright128(v.lo, v.hi, shift);
+	}
+
+	static INLINE uint128_t
+	add128(uint128_t a, uint128_t b) {
+		uint64_t t = a.lo;
+		a.lo += b.lo;
+		a.hi += b.hi + (a.lo < t);
+		return a;
+	}
+
+	static INLINE uint128_t
+	add128_64(uint128_t a, uint64_t b) {
+		uint64_t t = a.lo;
+		a.lo += b;
+		a.hi += (a.lo < t);
+		return a;
+	}
+
+	static INLINE uint64_t
+	lo128(uint128_t a) {
+		return a.lo;
+	}
+
+	static INLINE uint64_t
+	hi128(uint128_t a) {
+		return a.hi;
+	}
+#endif
+
+/* 0400-uint128-999.h */
+
+#if defined(HAVE_NATIVE_UINT128)
+	#define HAVE_UINT128
+
+	static INLINE uint128_t
+	mul64x64_128(uint64_t a, uint64_t b) {
+		return (uint128_t)a * b;
+	}
+
+	static INLINE uint64_t
+	shr128(uint128_t v, const int shift) {
+		return (uint64_t)(v >> shift);
+	}
+
+	static INLINE uint64_t
+	shr128_pair(uint64_t hi, uint64_t lo, const int shift) {
+		return (uint64_t)((((uint128_t)hi << 64) | lo) >> shift);
+	}
+
+	static INLINE uint128_t
+	add128(uint128_t a, uint128_t b) {
+		return a + b;
+	}
+
+	static INLINE uint128_t
+	add128_64(uint128_t a, uint64_t b) {
+		return a + b;
+	}
+
+	static INLINE uint64_t
+	lo128(uint128_t a) {
+		return (uint64_t)a;
+	}
+
+	static INLINE uint64_t
+	hi128(uint128_t a) {
+		return (uint64_t)(a >> 64);
+	}
+#endif
+
+#endif /* PORTABLE_JANE_H */
+

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/donna/verify_poly1305_donna.c

@@ -0,0 +1,10 @@
+#include "api.h"
+#include "crypto_onetimeauth_poly1305_donna.h"
+#include "crypto_verify_16.h"
+
+int crypto_onetimeauth_verify(const unsigned char *h,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  unsigned char correct[16];
+  crypto_onetimeauth(correct,in,inlen,k);
+  return crypto_verify_16(h,correct);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305.c

@@ -0,0 +1,36 @@
+
+#include "crypto_onetimeauth_poly1305.h"
+#include "crypto_onetimeauth_poly1305_donna.h"
+
+static const crypto_onetimeauth_poly1305_implementation *implementation =
+    &crypto_onetimeauth_poly1305_donna_implementation;
+
+int
+crypto_onetimeauth_poly1305_set_implementation(crypto_onetimeauth_poly1305_implementation *impl)
+{
+    implementation = impl;
+
+    return 0;
+}
+
+const char *
+crypto_onetimeauth_poly1305_implementation_name(void)
+{
+    return implementation->implementation_name();
+}
+
+int
+crypto_onetimeauth_poly1305(unsigned char *out, const unsigned char *in,
+                            unsigned long long inlen, const unsigned char *k)
+{
+    return implementation->onetimeauth(out, in, inlen, k);
+}
+
+int
+crypto_onetimeauth_poly1305_verify(const unsigned char *h,
+                                   const unsigned char *in,
+                                   unsigned long long inlen,
+                                   const unsigned char *k)
+{
+    return implementation->onetimeauth_verify(h, in, inlen, k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_api.c

@@ -0,0 +1,16 @@
+#include "crypto_onetimeauth_poly1305.h"
+
+size_t
+crypto_onetimeauth_poly1305_bytes(void) {
+    return crypto_onetimeauth_poly1305_BYTES;
+}
+
+size_t
+crypto_onetimeauth_poly1305_keybytes(void) {
+    return crypto_onetimeauth_poly1305_KEYBYTES;
+}
+
+const char *
+crypto_onetimeauth_poly1305_primitive(void) {
+    return "poly1305";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_onetimeauth/poly1305/onetimeauth_poly1305_try.c

@@ -0,0 +1,152 @@
+
+#include <stdlib.h>
+#include <string.h>
+#include "crypto_hash_sha256.h"
+#include "crypto_onetimeauth.h"
+#include "crypto_onetimeauth_poly1305.h"
+#include "crypto_onetimeauth_poly1305_donna.h"
+#include "crypto_onetimeauth_poly1305_53.h"
+#include "utils.h"
+
+#define MAXTEST_BYTES 10000
+#define CHECKSUM_BYTES 4096
+
+#define CHECKSUM "e836d5ca58cf673fca2b4910f23f3990"
+
+static char checksum[crypto_onetimeauth_BYTES * 2U + 1U];
+
+static unsigned char *h,  *h_;
+static unsigned char *m,  *m_;
+static unsigned char *k,  *k_;
+static unsigned char *h2, *h2_;
+static unsigned char *m2, *m2_;
+static unsigned char *k2, *k2_;
+
+static int
+allocate(void)
+{
+    h  = _sodium_alignedcalloc(&h_, crypto_onetimeauth_BYTES);
+    m  = _sodium_alignedcalloc(&m_, MAXTEST_BYTES);
+    k  = _sodium_alignedcalloc(&k_, crypto_onetimeauth_KEYBYTES);
+    h2 = _sodium_alignedcalloc(&h2_, crypto_onetimeauth_BYTES);
+    m2 = _sodium_alignedcalloc(&m2_, MAXTEST_BYTES + crypto_onetimeauth_BYTES);
+    k2 = _sodium_alignedcalloc(&k2_, crypto_onetimeauth_KEYBYTES +
+                               crypto_onetimeauth_BYTES);
+
+    return -!(h && m && k && h2 && m2 && k2);
+}
+
+static void
+deallocate(void)
+{
+    free(h_);
+    free(m_);
+    free(k_);
+    free(h2_);
+    free(m2_);
+    free(k2_);
+}
+
+#ifdef HAVE_ARC4RANDOM
+# undef rand
+# define rand(X) arc4random(X)
+#endif
+
+static const char *
+checksum_compute(void)
+{
+    long long i;
+    long long j;
+
+    for (i = 0;i < CHECKSUM_BYTES;++i) {
+        long long mlen = i;
+        long long klen = crypto_onetimeauth_KEYBYTES;
+        long long hlen = crypto_onetimeauth_BYTES;
+
+        for (j = -16;j < 0;++j) h[j] = rand();
+        for (j = -16;j < 0;++j) k[j] = rand();
+        for (j = -16;j < 0;++j) m[j] = rand();
+        for (j = hlen;j < hlen + 16;++j) h[j] = rand();
+        for (j = klen;j < klen + 16;++j) k[j] = rand();
+        for (j = mlen;j < mlen + 16;++j) m[j] = rand();
+        for (j = -16;j < hlen + 16;++j) h2[j] = h[j];
+        for (j = -16;j < klen + 16;++j) k2[j] = k[j];
+        for (j = -16;j < mlen + 16;++j) m2[j] = m[j];
+
+        if (crypto_onetimeauth(h,m,mlen,k) != 0) return "crypto_onetimeauth returns nonzero";
+
+        for (j = -16;j < klen + 16;++j) if (k[j] != k2[j]) return "crypto_onetimeauth overwrites k";
+        for (j = -16;j < mlen + 16;++j) if (m[j] != m2[j]) return "crypto_onetimeauth overwrites m";
+        for (j = -16;j < 0;++j) if (h[j] != h2[j]) return "crypto_onetimeauth writes before output";
+        for (j = hlen;j < hlen + 16;++j) if (h[j] != h2[j]) return "crypto_onetimeauth writes after output";
+
+        for (j = -16;j < 0;++j) h[j] = rand();
+        for (j = -16;j < 0;++j) k[j] = rand();
+        for (j = -16;j < 0;++j) m[j] = rand();
+        for (j = hlen;j < hlen + 16;++j) h[j] = rand();
+        for (j = klen;j < klen + 16;++j) k[j] = rand();
+        for (j = mlen;j < mlen + 16;++j) m[j] = rand();
+        for (j = -16;j < hlen + 16;++j) h2[j] = h[j];
+        for (j = -16;j < klen + 16;++j) k2[j] = k[j];
+        for (j = -16;j < mlen + 16;++j) m2[j] = m[j];
+
+        if (crypto_onetimeauth(m2,m2,mlen,k) != 0) return "crypto_onetimeauth returns nonzero";
+        for (j = 0;j < hlen;++j) if (m2[j] != h[j]) return "crypto_onetimeauth does not handle m overlap";
+        for (j = 0;j < hlen;++j) m2[j] = m[j];
+        if (crypto_onetimeauth(k2,m2,mlen,k2) != 0) return "crypto_onetimeauth returns nonzero";
+        for (j = 0;j < hlen;++j) if (k2[j] != h[j]) return "crypto_onetimeauth does not handle k overlap";
+        for (j = 0;j < hlen;++j) k2[j] = k[j];
+
+        if (crypto_onetimeauth_verify(h,m,mlen,k) != 0) return "crypto_onetimeauth_verify returns nonzero";
+
+        for (j = -16;j < hlen + 16;++j) if (h[j] != h2[j]) return "crypto_onetimeauth overwrites h";
+        for (j = -16;j < klen + 16;++j) if (k[j] != k2[j]) return "crypto_onetimeauth overwrites k";
+        for (j = -16;j < mlen + 16;++j) if (m[j] != m2[j]) return "crypto_onetimeauth overwrites m";
+
+        crypto_hash_sha256(h2,h,hlen);
+        for (j = 0;j < klen;++j) k[j] ^= h2[j % 32];
+        if (crypto_onetimeauth(h,m,mlen,k) != 0) return "crypto_onetimeauth returns nonzero";
+        if (crypto_onetimeauth_verify(h,m,mlen,k) != 0) return "crypto_onetimeauth_verify returns nonzero";
+
+        crypto_hash_sha256(h2,h,hlen);
+        for (j = 0;j < mlen;++j) m[j] ^= h2[j % 32];
+        m[mlen] = h2[0];
+    }
+    if (crypto_onetimeauth(h,m,CHECKSUM_BYTES,k) != 0) return "crypto_onetimeauth returns nonzero";
+    if (crypto_onetimeauth_verify(h,m,CHECKSUM_BYTES,k) != 0) return "crypto_onetimeauth_verify returns nonzero";
+
+    sodium_bin2hex(checksum, sizeof checksum, h, crypto_onetimeauth_BYTES);
+
+    return NULL;
+}
+
+crypto_onetimeauth_poly1305_implementation *
+crypto_onetimeauth_pick_best_implementation(void)
+{
+    crypto_onetimeauth_poly1305_implementation *implementations[] = {
+#ifdef HAVE_FENV_H
+        &crypto_onetimeauth_poly1305_53_implementation,
+#endif
+        &crypto_onetimeauth_poly1305_donna_implementation,
+        NULL
+    };
+    const char *err;
+    size_t      i = (size_t) 0U;
+
+    do {
+        if (crypto_onetimeauth_poly1305_set_implementation
+            (implementations[i]) != 0) {
+            continue;
+        }
+        if (allocate() != 0) {
+            return NULL;
+        }
+        err = checksum_compute();
+        deallocate();
+        if (err == NULL && strcmp(checksum, CHECKSUM) == 0) {
+            break;
+        }
+    } while (implementations[++i] != NULL);
+
+    return implementations[i];
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/crypto_scalarmult.c

@@ -0,0 +1,34 @@
+
+#include "crypto_scalarmult.h"
+
+size_t
+crypto_scalarmult_bytes(void)
+{
+    return crypto_scalarmult_BYTES;
+}
+
+size_t
+crypto_scalarmult_scalarbytes(void)
+{
+    return crypto_scalarmult_SCALARBYTES;
+}
+
+const char *
+crypto_scalarmult_primitive(void)
+{
+    return crypto_scalarmult_PRIMITIVE;
+}
+
+int
+crypto_scalarmult_base(unsigned char *q, const unsigned char *n)
+{
+    return crypto_scalarmult_curve25519_base(q, n);
+}
+
+int
+crypto_scalarmult(unsigned char *q, const unsigned char *n,
+                  const unsigned char *p)
+{
+    return crypto_scalarmult_curve25519(q, n, p);
+}
+

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/donna_c64/api.h

@@ -0,0 +1,9 @@
+
+#include "crypto_scalarmult_curve25519.h"
+
+#define crypto_scalarmult_curve25519_implementation_name \
+    crypto_scalarmult_curve25519_donna_c64_implementation_name
+
+#define crypto_scalarmult crypto_scalarmult_curve25519_donna_c64
+#define crypto_scalarmult_base crypto_scalarmult_curve25519_donna_c64_base
+

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/donna_c64/base_curve25519_donna_c64.c

@@ -0,0 +1,13 @@
+
+#include "api.h"
+
+#ifdef HAVE_TI_MODE
+
+static const unsigned char basepoint[32] = {9};
+
+int crypto_scalarmult_base(unsigned char *q,const unsigned char *n)
+{
+  return crypto_scalarmult(q, n, basepoint);
+}
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/donna_c64/smult_curve25519_donna_c64.c

@@ -0,0 +1,426 @@
+/* Copyright 2008, Google Inc.
+ * All rights reserved.
+ *
+ * Code released into the public domain.
+ *
+ * curve25519-donna: Curve25519 elliptic curve, public key function
+ *
+ * http://code.google.com/p/curve25519-donna/
+ *
+ * Adam Langley <agl@imperialviolet.org>
+ * Parts optimised by floodyberry
+ * Derived from public domain C code by Daniel J. Bernstein <djb@cr.yp.to>
+ *
+ * More information about curve25519 can be found here
+ *   http://cr.yp.to/ecdh.html
+ *
+ * djb's sample implementation of curve25519 is written in a special assembly
+ * language called qhasm and uses the floating point registers.
+ *
+ * This is, almost, a clean room reimplementation from the curve25519 paper. It
+ * uses many of the tricks described therein. Only the crecip function is taken
+ * from the sample implementation.
+ */
+
+#include <string.h>
+#include <stdint.h>
+#include "api.h"
+
+#ifdef HAVE_TI_MODE
+
+typedef uint8_t u8;
+typedef uint64_t limb;
+typedef limb felem[5];
+// This is a special gcc mode for 128-bit integers. It's implemented on 64-bit
+// platforms only as far as I know.
+typedef unsigned uint128_t __attribute__((mode(TI)));
+
+#undef force_inline
+#define force_inline inline __attribute__((always_inline))
+
+/* Sum two numbers: output += in */
+static force_inline void
+fsum(limb *output, const limb *in) {
+  output[0] += in[0];
+  output[1] += in[1];
+  output[2] += in[2];
+  output[3] += in[3];
+  output[4] += in[4];
+}
+
+/* Find the difference of two numbers: output = in - output
+ * (note the order of the arguments!)
+ *
+ * Assumes that out[i] < 2**52
+ * On return, out[i] < 2**55
+ */
+static force_inline void
+fdifference_backwards(felem out, const felem in) {
+  /* 152 is 19 << 3 */
+  static const limb two54m152 = (((limb)1) << 54) - 152;
+  static const limb two54m8 = (((limb)1) << 54) - 8;
+
+  out[0] = in[0] + two54m152 - out[0];
+  out[1] = in[1] + two54m8 - out[1];
+  out[2] = in[2] + two54m8 - out[2];
+  out[3] = in[3] + two54m8 - out[3];
+  out[4] = in[4] + two54m8 - out[4];
+}
+
+/* Multiply a number by a scalar: output = in * scalar */
+static force_inline void
+fscalar_product(felem output, const felem in, const limb scalar) {
+  uint128_t a;
+
+  a = ((uint128_t) in[0]) * scalar;
+  output[0] = ((limb)a) & 0x7ffffffffffff;
+
+  a = ((uint128_t) in[1]) * scalar + ((limb) (a >> 51));
+  output[1] = ((limb)a) & 0x7ffffffffffff;
+
+  a = ((uint128_t) in[2]) * scalar + ((limb) (a >> 51));
+  output[2] = ((limb)a) & 0x7ffffffffffff;
+
+  a = ((uint128_t) in[3]) * scalar + ((limb) (a >> 51));
+  output[3] = ((limb)a) & 0x7ffffffffffff;
+
+  a = ((uint128_t) in[4]) * scalar + ((limb) (a >> 51));
+  output[4] = ((limb)a) & 0x7ffffffffffff;
+
+  output[0] += (a >> 51) * 19;
+}
+
+/* Multiply two numbers: output = in2 * in
+ *
+ * output must be distinct to both inputs. The inputs are reduced coefficient
+ * form, the output is not.
+ *
+ * Assumes that in[i] < 2**55 and likewise for in2.
+ * On return, output[i] < 2**52
+ */
+static force_inline void
+fmul(felem output, const felem in2, const felem in) {
+  uint128_t t[5];
+  limb r0,r1,r2,r3,r4,s0,s1,s2,s3,s4,c;
+
+  r0 = in[0];
+  r1 = in[1];
+  r2 = in[2];
+  r3 = in[3];
+  r4 = in[4];
+
+  s0 = in2[0];
+  s1 = in2[1];
+  s2 = in2[2];
+  s3 = in2[3];
+  s4 = in2[4];
+
+  t[0]  =  ((uint128_t) r0) * s0;
+  t[1]  =  ((uint128_t) r0) * s1 + ((uint128_t) r1) * s0;
+  t[2]  =  ((uint128_t) r0) * s2 + ((uint128_t) r2) * s0 + ((uint128_t) r1) * s1;
+  t[3]  =  ((uint128_t) r0) * s3 + ((uint128_t) r3) * s0 + ((uint128_t) r1) * s2 + ((uint128_t) r2) * s1;
+  t[4]  =  ((uint128_t) r0) * s4 + ((uint128_t) r4) * s0 + ((uint128_t) r3) * s1 + ((uint128_t) r1) * s3 + ((uint128_t) r2) * s2;
+
+  r4 *= 19;
+  r1 *= 19;
+  r2 *= 19;
+  r3 *= 19;
+
+  t[0] += ((uint128_t) r4) * s1 + ((uint128_t) r1) * s4 + ((uint128_t) r2) * s3 + ((uint128_t) r3) * s2;
+  t[1] += ((uint128_t) r4) * s2 + ((uint128_t) r2) * s4 + ((uint128_t) r3) * s3;
+  t[2] += ((uint128_t) r4) * s3 + ((uint128_t) r3) * s4;
+  t[3] += ((uint128_t) r4) * s4;
+
+                  r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51);
+  t[1] += c;      r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51);
+  t[2] += c;      r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51);
+  t[3] += c;      r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51);
+  t[4] += c;      r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51);
+  r0 +=   c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff;
+  r1 +=   c;      c = r1 >> 51; r1 = r1 & 0x7ffffffffffff;
+  r2 +=   c;
+
+  output[0] = r0;
+  output[1] = r1;
+  output[2] = r2;
+  output[3] = r3;
+  output[4] = r4;
+}
+
+static force_inline void
+fsquare_times(felem output, const felem in, limb count) {
+  uint128_t t[5];
+  limb r0,r1,r2,r3,r4,c;
+  limb d0,d1,d2,d4,d419;
+
+  r0 = in[0];
+  r1 = in[1];
+  r2 = in[2];
+  r3 = in[3];
+  r4 = in[4];
+
+  do {
+    d0 = r0 * 2;
+    d1 = r1 * 2;
+    d2 = r2 * 2 * 19;
+    d419 = r4 * 19;
+    d4 = d419 * 2;
+
+    t[0] = ((uint128_t) r0) * r0 + ((uint128_t) d4) * r1 + (((uint128_t) d2) * (r3     ));
+    t[1] = ((uint128_t) d0) * r1 + ((uint128_t) d4) * r2 + (((uint128_t) r3) * (r3 * 19));
+    t[2] = ((uint128_t) d0) * r2 + ((uint128_t) r1) * r1 + (((uint128_t) d4) * (r3     ));
+    t[3] = ((uint128_t) d0) * r3 + ((uint128_t) d1) * r2 + (((uint128_t) r4) * (d419   ));
+    t[4] = ((uint128_t) d0) * r4 + ((uint128_t) d1) * r3 + (((uint128_t) r2) * (r2     ));
+
+                    r0 = (limb)t[0] & 0x7ffffffffffff; c = (limb)(t[0] >> 51);
+    t[1] += c;      r1 = (limb)t[1] & 0x7ffffffffffff; c = (limb)(t[1] >> 51);
+    t[2] += c;      r2 = (limb)t[2] & 0x7ffffffffffff; c = (limb)(t[2] >> 51);
+    t[3] += c;      r3 = (limb)t[3] & 0x7ffffffffffff; c = (limb)(t[3] >> 51);
+    t[4] += c;      r4 = (limb)t[4] & 0x7ffffffffffff; c = (limb)(t[4] >> 51);
+    r0 +=   c * 19; c = r0 >> 51; r0 = r0 & 0x7ffffffffffff;
+    r1 +=   c;      c = r1 >> 51; r1 = r1 & 0x7ffffffffffff;
+    r2 +=   c;
+  } while(--count);
+
+  output[0] = r0;
+  output[1] = r1;
+  output[2] = r2;
+  output[3] = r3;
+  output[4] = r4;
+}
+
+/* Take a little-endian, 32-byte number and expand it into polynomial form */
+static void
+fexpand(limb *output, const u8 *in) {
+  output[0] = *((const uint64_t *)(in)) & 0x7ffffffffffff;
+  output[1] = (*((const uint64_t *)(in+6)) >> 3) & 0x7ffffffffffff;
+  output[2] = (*((const uint64_t *)(in+12)) >> 6) & 0x7ffffffffffff;
+  output[3] = (*((const uint64_t *)(in+19)) >> 1) & 0x7ffffffffffff;
+  output[4] = (*((const uint64_t *)(in+25)) >> 4) & 0xfffffffffffff;
+}
+
+/* Take a fully reduced polynomial form number and contract it into a
+ * little-endian, 32-byte array
+ */
+static void
+fcontract(u8 *output, const felem input) {
+  uint128_t t[5];
+
+  t[0] = input[0];
+  t[1] = input[1];
+  t[2] = input[2];
+  t[3] = input[3];
+  t[4] = input[4];
+
+  t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
+  t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
+  t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
+  t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
+  t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
+
+  t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
+  t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
+  t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
+  t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
+  t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
+
+  /* now t is between 0 and 2^255-1, properly carried. */
+  /* case 1: between 0 and 2^255-20. case 2: between 2^255-19 and 2^255-1. */
+
+  t[0] += 19;
+
+  t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
+  t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
+  t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
+  t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
+  t[0] += 19 * (t[4] >> 51); t[4] &= 0x7ffffffffffff;
+
+  /* now between 19 and 2^255-1 in both cases, and offset by 19. */
+
+  t[0] += 0x8000000000000 - 19;
+  t[1] += 0x8000000000000 - 1;
+  t[2] += 0x8000000000000 - 1;
+  t[3] += 0x8000000000000 - 1;
+  t[4] += 0x8000000000000 - 1;
+
+  /* now between 2^255 and 2^256-20, and offset by 2^255. */
+
+  t[1] += t[0] >> 51; t[0] &= 0x7ffffffffffff;
+  t[2] += t[1] >> 51; t[1] &= 0x7ffffffffffff;
+  t[3] += t[2] >> 51; t[2] &= 0x7ffffffffffff;
+  t[4] += t[3] >> 51; t[3] &= 0x7ffffffffffff;
+  t[4] &= 0x7ffffffffffff;
+
+  *((uint64_t *)(output)) = t[0] | (t[1] << 51);
+  *((uint64_t *)(output+8)) = (t[1] >> 13) | (t[2] << 38);
+  *((uint64_t *)(output+16)) = (t[2] >> 26) | (t[3] << 25);
+  *((uint64_t *)(output+24)) = (t[3] >> 39) | (t[4] << 12);
+}
+
+/* Input: Q, Q', Q-Q'
+ * Output: 2Q, Q+Q'
+ *
+ *   x2 z3: long form
+ *   x3 z3: long form
+ *   x z: short form, destroyed
+ *   xprime zprime: short form, destroyed
+ *   qmqp: short form, preserved
+ */
+static void
+fmonty(limb *x2, limb *z2, /* output 2Q */
+       limb *x3, limb *z3, /* output Q + Q' */
+       limb *x, limb *z,   /* input Q */
+       limb *xprime, limb *zprime, /* input Q' */
+       const limb *qmqp /* input Q - Q' */) {
+  limb origx[5], origxprime[5], zzz[5], xx[5], zz[5], xxprime[5],
+        zzprime[5], zzzprime[5];
+
+  memcpy(origx, x, 5 * sizeof(limb));
+  fsum(x, z);
+  fdifference_backwards(z, origx);  // does x - z
+
+  memcpy(origxprime, xprime, sizeof(limb) * 5);
+  fsum(xprime, zprime);
+  fdifference_backwards(zprime, origxprime);
+  fmul(xxprime, xprime, z);
+  fmul(zzprime, x, zprime);
+  memcpy(origxprime, xxprime, sizeof(limb) * 5);
+  fsum(xxprime, zzprime);
+  fdifference_backwards(zzprime, origxprime);
+  fsquare_times(x3, xxprime, 1);
+  fsquare_times(zzzprime, zzprime, 1);
+  fmul(z3, zzzprime, qmqp);
+
+  fsquare_times(xx, x, 1);
+  fsquare_times(zz, z, 1);
+  fmul(x2, xx, zz);
+  fdifference_backwards(zz, xx);  // does zz = xx - zz
+  fscalar_product(zzz, zz, 121665);
+  fsum(zzz, xx);
+  fmul(z2, zz, zzz);
+}
+
+// -----------------------------------------------------------------------------
+// Maybe swap the contents of two limb arrays (@a and @b), each @len elements
+// long. Perform the swap iff @swap is non-zero.
+//
+// This function performs the swap without leaking any side-channel
+// information.
+// -----------------------------------------------------------------------------
+static void
+swap_conditional(limb a[5], limb b[5], limb iswap) {
+  unsigned i;
+  const limb swap = -iswap;
+
+  for (i = 0; i < 5; ++i) {
+    const limb x = swap & (a[i] ^ b[i]);
+    a[i] ^= x;
+    b[i] ^= x;
+  }
+}
+
+/* Calculates nQ where Q is the x-coordinate of a point on the curve
+ *
+ *   resultx/resultz: the x coordinate of the resulting curve point (short form)
+ *   n: a little endian, 32-byte number
+ *   q: a point of the curve (short form)
+ */
+static void
+cmult(limb *resultx, limb *resultz, const u8 *n, const limb *q) {
+  limb a[5] = {0}, b[5] = {1}, c[5] = {1}, d[5] = {0};
+  limb *nqpqx = a, *nqpqz = b, *nqx = c, *nqz = d, *t;
+  limb e[5] = {0}, f[5] = {1}, g[5] = {0}, h[5] = {1};
+  limb *nqpqx2 = e, *nqpqz2 = f, *nqx2 = g, *nqz2 = h;
+
+  unsigned i, j;
+
+  memcpy(nqpqx, q, sizeof(limb) * 5);
+
+  for (i = 0; i < 32; ++i) {
+    u8 byte = n[31 - i];
+    for (j = 0; j < 8; ++j) {
+      const limb bit = byte >> 7;
+
+      swap_conditional(nqx, nqpqx, bit);
+      swap_conditional(nqz, nqpqz, bit);
+      fmonty(nqx2, nqz2,
+             nqpqx2, nqpqz2,
+             nqx, nqz,
+             nqpqx, nqpqz,
+             q);
+      swap_conditional(nqx2, nqpqx2, bit);
+      swap_conditional(nqz2, nqpqz2, bit);
+
+      t = nqx;
+      nqx = nqx2;
+      nqx2 = t;
+      t = nqz;
+      nqz = nqz2;
+      nqz2 = t;
+      t = nqpqx;
+      nqpqx = nqpqx2;
+      nqpqx2 = t;
+      t = nqpqz;
+      nqpqz = nqpqz2;
+      nqpqz2 = t;
+
+      byte <<= 1;
+    }
+  }
+
+  memcpy(resultx, nqx, sizeof(limb) * 5);
+  memcpy(resultz, nqz, sizeof(limb) * 5);
+}
+
+
+// -----------------------------------------------------------------------------
+// Shamelessly copied from djb's code, tightened a little
+// -----------------------------------------------------------------------------
+static void
+crecip(felem out, const felem z) {
+  felem a,t0,b,c;
+
+  /* 2 */ fsquare_times(a, z, 1); // a = 2
+  /* 8 */ fsquare_times(t0, a, 2);
+  /* 9 */ fmul(b, t0, z); // b = 9
+  /* 11 */ fmul(a, b, a); // a = 11
+  /* 22 */ fsquare_times(t0, a, 1);
+  /* 2^5 - 2^0 = 31 */ fmul(b, t0, b);
+  /* 2^10 - 2^5 */ fsquare_times(t0, b, 5);
+  /* 2^10 - 2^0 */ fmul(b, t0, b);
+  /* 2^20 - 2^10 */ fsquare_times(t0, b, 10);
+  /* 2^20 - 2^0 */ fmul(c, t0, b);
+  /* 2^40 - 2^20 */ fsquare_times(t0, c, 20);
+  /* 2^40 - 2^0 */ fmul(t0, t0, c);
+  /* 2^50 - 2^10 */ fsquare_times(t0, t0, 10);
+  /* 2^50 - 2^0 */ fmul(b, t0, b);
+  /* 2^100 - 2^50 */ fsquare_times(t0, b, 50);
+  /* 2^100 - 2^0 */ fmul(c, t0, b);
+  /* 2^200 - 2^100 */ fsquare_times(t0, c, 100);
+  /* 2^200 - 2^0 */ fmul(t0, t0, c);
+  /* 2^250 - 2^50 */ fsquare_times(t0, t0, 50);
+  /* 2^250 - 2^0 */ fmul(t0, t0, b);
+  /* 2^255 - 2^5 */ fsquare_times(t0, t0, 5);
+  /* 2^255 - 21 */ fmul(out, t0, a);
+}
+
+int
+crypto_scalarmult(u8 *mypublic, const u8 *secret, const u8 *basepoint) {
+  limb bp[5], x[5], z[5], zmone[5];
+  uint8_t e[32];
+  int i;
+
+  for (i = 0;i < 32;++i) e[i] = secret[i];
+  e[0] &= 248;
+  e[31] &= 127;
+  e[31] |= 64;
+
+  fexpand(bp, basepoint);
+  cmult(x, z, e, bp);
+  crecip(zmone, z);
+  fmul(z, x, zmone);
+  fcontract(mypublic, z);
+  return 0;
+}
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/ref/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_scalarmult_curve25519.h"
+
+#define crypto_scalarmult_curve25519_implementation_name \
+    crypto_scalarmult_curve25519_ref_implementation_name
+
+#define crypto_scalarmult crypto_scalarmult_curve25519_ref
+#define crypto_scalarmult_base crypto_scalarmult_curve25519_ref_base

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/ref/base_curve25519_ref.c

@@ -0,0 +1,20 @@
+/*
+version 20081011
+Matthew Dempsky
+Public domain.
+Derived from public domain code by D. J. Bernstein.
+*/
+
+#include "api.h"
+
+#ifndef HAVE_TI_MODE
+
+const unsigned char base[32] = {9};
+
+int crypto_scalarmult_base(unsigned char *q,
+  const unsigned char *n)
+{
+  return crypto_scalarmult(q,n,base);
+}
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/ref/smult_curve25519_ref.c

@@ -0,0 +1,268 @@
+/*
+version 20081011
+Matthew Dempsky
+Public domain.
+Derived from public domain code by D. J. Bernstein.
+*/
+
+#include "api.h"
+
+#ifndef HAVE_TI_MODE
+
+static void add(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 0;
+  for (j = 0;j < 31;++j) { u += a[j] + b[j]; out[j] = u & 255; u >>= 8; }
+  u += a[31] + b[31]; out[31] = u;
+}
+
+static void sub(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 218;
+  for (j = 0;j < 31;++j) {
+    u += a[j] + 65280 - b[j];
+    out[j] = u & 255;
+    u >>= 8;
+  }
+  u += a[31] - b[31];
+  out[31] = u;
+}
+
+static void squeeze(unsigned int a[32])
+{
+  unsigned int j;
+  unsigned int u;
+  u = 0;
+  for (j = 0;j < 31;++j) { u += a[j]; a[j] = u & 255; u >>= 8; }
+  u += a[31]; a[31] = u & 127;
+  u = 19 * (u >> 7);
+  for (j = 0;j < 31;++j) { u += a[j]; a[j] = u & 255; u >>= 8; }
+  u += a[31]; a[31] = u;
+}
+
+static const unsigned int minusp[32] = {
+ 19, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 128
+} ;
+
+static void freeze(unsigned int a[32])
+{
+  unsigned int aorig[32];
+  unsigned int j;
+  unsigned int negative;
+
+  for (j = 0;j < 32;++j) aorig[j] = a[j];
+  add(a,a,minusp);
+  negative = -((a[31] >> 7) & 1);
+  for (j = 0;j < 32;++j) a[j] ^= negative & (aorig[j] ^ a[j]);
+}
+
+static void mult(unsigned int out[32],const unsigned int a[32],const unsigned int b[32])
+{
+  unsigned int i;
+  unsigned int j;
+  unsigned int u;
+
+  for (i = 0;i < 32;++i) {
+    u = 0;
+    for (j = 0;j <= i;++j) u += a[j] * b[i - j];
+    for (j = i + 1;j < 32;++j) u += 38 * a[j] * b[i + 32 - j];
+    out[i] = u;
+  }
+  squeeze(out);
+}
+
+static void mult121665(unsigned int out[32],const unsigned int a[32])
+{
+  unsigned int j;
+  unsigned int u;
+
+  u = 0;
+  for (j = 0;j < 31;++j) { u += 121665 * a[j]; out[j] = u & 255; u >>= 8; }
+  u += 121665 * a[31]; out[31] = u & 127;
+  u = 19 * (u >> 7);
+  for (j = 0;j < 31;++j) { u += out[j]; out[j] = u & 255; u >>= 8; }
+  u += out[j]; out[j] = u;
+}
+
+static void square(unsigned int out[32],const unsigned int a[32])
+{
+  unsigned int i;
+  unsigned int j;
+  unsigned int u;
+
+  for (i = 0;i < 32;++i) {
+    u = 0;
+    for (j = 0;j < i - j;++j) u += a[j] * a[i - j];
+    for (j = i + 1;j < i + 32 - j;++j) u += 38 * a[j] * a[i + 32 - j];
+    u *= 2;
+    if ((i & 1) == 0) {
+      u += a[i / 2] * a[i / 2];
+      u += 38 * a[i / 2 + 16] * a[i / 2 + 16];
+    }
+    out[i] = u;
+  }
+  squeeze(out);
+}
+
+static void select(unsigned int p[64],unsigned int q[64],const unsigned int r[64],const unsigned int s[64],unsigned int b)
+{
+  unsigned int j;
+  unsigned int t;
+  unsigned int bminus1;
+
+  bminus1 = b - 1;
+  for (j = 0;j < 64;++j) {
+    t = bminus1 & (r[j] ^ s[j]);
+    p[j] = s[j] ^ t;
+    q[j] = r[j] ^ t;
+  }
+}
+
+static void mainloop(unsigned int work[64],const unsigned char e[32])
+{
+  unsigned int xzm1[64];
+  unsigned int xzm[64];
+  unsigned int xzmb[64];
+  unsigned int xzm1b[64];
+  unsigned int xznb[64];
+  unsigned int xzn1b[64];
+  unsigned int a0[64];
+  unsigned int a1[64];
+  unsigned int b0[64];
+  unsigned int b1[64];
+  unsigned int c1[64];
+  unsigned int r[32];
+  unsigned int s[32];
+  unsigned int t[32];
+  unsigned int u[32];
+  unsigned int j;
+  unsigned int b;
+  int pos;
+
+  for (j = 0;j < 32;++j) xzm1[j] = work[j];
+  xzm1[32] = 1;
+  for (j = 33;j < 64;++j) xzm1[j] = 0;
+
+  xzm[0] = 1;
+  for (j = 1;j < 64;++j) xzm[j] = 0;
+
+  for (pos = 254;pos >= 0;--pos) {
+    b = e[pos / 8] >> (pos & 7);
+    b &= 1;
+    select(xzmb,xzm1b,xzm,xzm1,b);
+    add(a0,xzmb,xzmb + 32);
+    sub(a0 + 32,xzmb,xzmb + 32);
+    add(a1,xzm1b,xzm1b + 32);
+    sub(a1 + 32,xzm1b,xzm1b + 32);
+    square(b0,a0);
+    square(b0 + 32,a0 + 32);
+    mult(b1,a1,a0 + 32);
+    mult(b1 + 32,a1 + 32,a0);
+    add(c1,b1,b1 + 32);
+    sub(c1 + 32,b1,b1 + 32);
+    square(r,c1 + 32);
+    sub(s,b0,b0 + 32);
+    mult121665(t,s);
+    add(u,t,b0);
+    mult(xznb,b0,b0 + 32);
+    mult(xznb + 32,s,u);
+    square(xzn1b,c1);
+    mult(xzn1b + 32,r,work);
+    select(xzm,xzm1,xznb,xzn1b,b);
+  }
+
+  for (j = 0;j < 64;++j) work[j] = xzm[j];
+}
+
+static void recip(unsigned int out[32],const unsigned int z[32])
+{
+  unsigned int z2[32];
+  unsigned int z9[32];
+  unsigned int z11[32];
+  unsigned int z2_5_0[32];
+  unsigned int z2_10_0[32];
+  unsigned int z2_20_0[32];
+  unsigned int z2_50_0[32];
+  unsigned int z2_100_0[32];
+  unsigned int t0[32];
+  unsigned int t1[32];
+  int i;
+
+  /* 2 */ square(z2,z);
+  /* 4 */ square(t1,z2);
+  /* 8 */ square(t0,t1);
+  /* 9 */ mult(z9,t0,z);
+  /* 11 */ mult(z11,z9,z2);
+  /* 22 */ square(t0,z11);
+  /* 2^5 - 2^0 = 31 */ mult(z2_5_0,t0,z9);
+
+  /* 2^6 - 2^1 */ square(t0,z2_5_0);
+  /* 2^7 - 2^2 */ square(t1,t0);
+  /* 2^8 - 2^3 */ square(t0,t1);
+  /* 2^9 - 2^4 */ square(t1,t0);
+  /* 2^10 - 2^5 */ square(t0,t1);
+  /* 2^10 - 2^0 */ mult(z2_10_0,t0,z2_5_0);
+
+  /* 2^11 - 2^1 */ square(t0,z2_10_0);
+  /* 2^12 - 2^2 */ square(t1,t0);
+  /* 2^20 - 2^10 */ for (i = 2;i < 10;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^20 - 2^0 */ mult(z2_20_0,t1,z2_10_0);
+
+  /* 2^21 - 2^1 */ square(t0,z2_20_0);
+  /* 2^22 - 2^2 */ square(t1,t0);
+  /* 2^40 - 2^20 */ for (i = 2;i < 20;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^40 - 2^0 */ mult(t0,t1,z2_20_0);
+
+  /* 2^41 - 2^1 */ square(t1,t0);
+  /* 2^42 - 2^2 */ square(t0,t1);
+  /* 2^50 - 2^10 */ for (i = 2;i < 10;i += 2) { square(t1,t0); square(t0,t1); }
+  /* 2^50 - 2^0 */ mult(z2_50_0,t0,z2_10_0);
+
+  /* 2^51 - 2^1 */ square(t0,z2_50_0);
+  /* 2^52 - 2^2 */ square(t1,t0);
+  /* 2^100 - 2^50 */ for (i = 2;i < 50;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^100 - 2^0 */ mult(z2_100_0,t1,z2_50_0);
+
+  /* 2^101 - 2^1 */ square(t1,z2_100_0);
+  /* 2^102 - 2^2 */ square(t0,t1);
+  /* 2^200 - 2^100 */ for (i = 2;i < 100;i += 2) { square(t1,t0); square(t0,t1); }
+  /* 2^200 - 2^0 */ mult(t1,t0,z2_100_0);
+
+  /* 2^201 - 2^1 */ square(t0,t1);
+  /* 2^202 - 2^2 */ square(t1,t0);
+  /* 2^250 - 2^50 */ for (i = 2;i < 50;i += 2) { square(t0,t1); square(t1,t0); }
+  /* 2^250 - 2^0 */ mult(t0,t1,z2_50_0);
+
+  /* 2^251 - 2^1 */ square(t1,t0);
+  /* 2^252 - 2^2 */ square(t0,t1);
+  /* 2^253 - 2^3 */ square(t1,t0);
+  /* 2^254 - 2^4 */ square(t0,t1);
+  /* 2^255 - 2^5 */ square(t1,t0);
+  /* 2^255 - 21 */ mult(out,t1,z11);
+}
+
+int crypto_scalarmult(unsigned char *q,
+  const unsigned char *n,
+  const unsigned char *p)
+{
+  unsigned int work[96];
+  unsigned char e[32];
+  unsigned int i;
+  for (i = 0;i < 32;++i) e[i] = n[i];
+  e[0] &= 248;
+  e[31] &= 127;
+  e[31] |= 64;
+  for (i = 0;i < 32;++i) work[i] = p[i];
+  mainloop(work,e);
+  recip(work + 32,work + 32);
+  mult(work + 64,work,work + 32);
+  freeze(work + 64);
+  for (i = 0;i < 32;++i) q[i] = work[64 + i];
+  return 0;
+}
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_scalarmult/curve25519/scalarmult_curve25519_api.c

@@ -0,0 +1,14 @@
+
+#include "crypto_scalarmult_curve25519.h"
+
+size_t
+crypto_scalarmult_curve25519_bytes(void)
+{
+    return crypto_scalarmult_curve25519_BYTES;
+}
+
+size_t
+crypto_scalarmult_curve25519_scalarbytes(void)
+{
+    return crypto_scalarmult_curve25519_SCALARBYTES;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_secretbox/crypto_secretbox.c

@@ -0,0 +1,48 @@
+
+#include "crypto_secretbox.h"
+
+size_t
+crypto_secretbox_keybytes(void)
+{
+    return crypto_secretbox_KEYBYTES;
+}
+
+size_t
+crypto_secretbox_noncebytes(void)
+{
+    return crypto_secretbox_NONCEBYTES;
+}
+
+size_t
+crypto_secretbox_zerobytes(void)
+{
+    return crypto_secretbox_ZEROBYTES;
+}
+
+size_t
+crypto_secretbox_boxzerobytes(void)
+{
+    return crypto_secretbox_BOXZEROBYTES;
+}
+
+const char *
+crypto_secretbox_primitive(void)
+{
+    return crypto_secretbox_PRIMITIVE;
+}
+
+int
+crypto_secretbox(unsigned char *c, const unsigned char *m,
+                 unsigned long long mlen, const unsigned char *n,
+                 const unsigned char *k)
+{
+    return crypto_secretbox_xsalsa20poly1305(c, m, mlen, n, k);
+}
+
+int
+crypto_secretbox_open(unsigned char *m, const unsigned char *c,
+                      unsigned long long clen, const unsigned char *n,
+                      const unsigned char *k)
+{
+    return crypto_secretbox_xsalsa20poly1305_open(m, c, clen, n, k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/api.h

@@ -0,0 +1,12 @@
+
+#include "crypto_secretbox_xsalsa20poly1305.h"
+
+#define crypto_secretbox crypto_secretbox_xsalsa20poly1305
+#define crypto_secretbox_open crypto_secretbox_xsalsa20poly1305_open
+#define crypto_secretbox_KEYBYTES crypto_secretbox_xsalsa20poly1305_KEYBYTES
+#define crypto_secretbox_NONCEBYTES crypto_secretbox_xsalsa20poly1305_NONCEBYTES
+#define crypto_secretbox_ZEROBYTES crypto_secretbox_xsalsa20poly1305_ZEROBYTES
+#define crypto_secretbox_BOXZEROBYTES crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES
+#define crypto_secretbox_PRIMITIVE "xsalsa20poly1305"
+#define crypto_secretbox_IMPLEMENTATION crypto_secretbox_xsalsa20poly1305_IMPLEMENTATION
+#define crypto_secretbox_VERSION crypto_secretbox_xsalsa20poly1305_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_secretbox/xsalsa20poly1305/ref/box_xsalsa20poly1305.c

@@ -0,0 +1,35 @@
+#include "api.h"
+#include "crypto_onetimeauth_poly1305.h"
+#include "crypto_stream_xsalsa20.h"
+
+int crypto_secretbox(
+  unsigned char *c,
+  const unsigned char *m,unsigned long long mlen,
+  const unsigned char *n,
+  const unsigned char *k
+)
+{
+  int i;
+  if (mlen < 32) return -1;
+  crypto_stream_xsalsa20_xor(c,m,mlen,n,k);
+  crypto_onetimeauth_poly1305(c + 16,c + 32,mlen - 32,c);
+  for (i = 0;i < 16;++i) c[i] = 0;
+  return 0;
+}
+
+int crypto_secretbox_open(
+  unsigned char *m,
+  const unsigned char *c,unsigned long long clen,
+  const unsigned char *n,
+  const unsigned char *k
+)
+{
+  int i;
+  unsigned char subkey[32];
+  if (clen < 32) return -1;
+  crypto_stream_xsalsa20(subkey,32,n,k);
+  if (crypto_onetimeauth_poly1305_verify(c + 16,c + 32,clen - 32,subkey) != 0) return -1;
+  crypto_stream_xsalsa20_xor(m,c,clen,n,k);
+  for (i = 0;i < 32;++i) m[i] = 0;
+  return 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_secretbox/xsalsa20poly1305/secretbox_xsalsa20poly1305_api.c

@@ -0,0 +1,26 @@
+#include "crypto_secretbox_xsalsa20poly1305.h"
+
+size_t
+crypto_secretbox_xsalsa20poly1305_keybytes(void) {
+    return crypto_secretbox_xsalsa20poly1305_KEYBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_noncebytes(void) {
+    return crypto_secretbox_xsalsa20poly1305_NONCEBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_zerobytes(void) {
+    return crypto_secretbox_xsalsa20poly1305_ZEROBYTES;
+}
+
+size_t
+crypto_secretbox_xsalsa20poly1305_boxzerobytes(void) {
+    return crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES;
+}
+
+const char *
+crypto_secretbox_xsalsa20poly1305_primitive(void) {
+    return "xsalsa20poly1305";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_shorthash/crypto_shorthash.c

@@ -0,0 +1,27 @@
+
+#include "crypto_shorthash.h"
+
+size_t
+crypto_shorthash_bytes(void)
+{
+    return crypto_shorthash_BYTES;
+}
+
+size_t
+crypto_shorthash_keybytes(void)
+{
+    return crypto_shorthash_KEYBYTES;
+}
+
+const char *
+crypto_shorthash_primitive(void)
+{
+    return crypto_shorthash_PRIMITIVE;
+}
+
+int
+crypto_shorthash(unsigned char *out, const unsigned char *in,
+                 unsigned long long inlen, const unsigned char *k)
+{
+    return crypto_shorthash_siphash24(out, in, inlen, k);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_shorthash/siphash24/ref/api.h

@@ -0,0 +1,8 @@
+
+#include "crypto_shorthash_siphash24.h"
+
+#define crypto_shorthash crypto_shorthash_siphash24
+#define crypto_shorthash_BYTES crypto_shorthash_siphash24_BYTES
+#define crypto_shorthash_PRIMITIVE "siphash24"
+#define crypto_shorthash_IMPLEMENTATION crypto_shorthash_siphash24_IMPLEMENTATION
+#define crypto_shorthash_VERSION crypto_shorthash_siphash24_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_shorthash/siphash24/ref/shorthash_siphash24.c

@@ -0,0 +1,91 @@
+#include "api.h"
+#include "crypto_uint64.h"
+#include "crypto_uint32.h"
+#include "crypto_uint8.h"
+
+typedef crypto_uint64 u64;
+typedef crypto_uint32 u32;
+typedef crypto_uint8   u8;
+
+#define ROTL(x,b) (u64)( ((x) << (b)) | ( (x) >> (64 - (b))) )
+
+#define U32TO8_LE(p, v)         \
+    (p)[0] = (u8)((v)      ); (p)[1] = (u8)((v) >>  8); \
+    (p)[2] = (u8)((v) >> 16); (p)[3] = (u8)((v) >> 24);
+
+#define U64TO8_LE(p, v)         \
+  U32TO8_LE((p),     (u32)((v)      ));   \
+  U32TO8_LE((p) + 4, (u32)((v) >> 32));
+
+#define U8TO64_LE(p) \
+  (((u64)((p)[0])      ) | \
+   ((u64)((p)[1]) <<  8) | \
+   ((u64)((p)[2]) << 16) | \
+   ((u64)((p)[3]) << 24) | \
+   ((u64)((p)[4]) << 32) | \
+   ((u64)((p)[5]) << 40) | \
+   ((u64)((p)[6]) << 48) | \
+   ((u64)((p)[7]) << 56))
+
+#define SIPROUND            \
+  do {              \
+    v0 += v1; v1=ROTL(v1,13); v1 ^= v0; v0=ROTL(v0,32); \
+    v2 += v3; v3=ROTL(v3,16); v3 ^= v2;     \
+    v0 += v3; v3=ROTL(v3,21); v3 ^= v0;     \
+    v2 += v1; v1=ROTL(v1,17); v1 ^= v2; v2=ROTL(v2,32); \
+  } while(0)
+
+int crypto_shorthash(unsigned char *out,const unsigned char *in,unsigned long long inlen,const unsigned char *k)
+{
+  /* "somepseudorandomlygeneratedbytes" */
+  u64 v0 = 0x736f6d6570736575ULL;
+  u64 v1 = 0x646f72616e646f6dULL;
+  u64 v2 = 0x6c7967656e657261ULL;
+  u64 v3 = 0x7465646279746573ULL;
+  u64 b;
+  u64 k0 = U8TO64_LE( k );
+  u64 k1 = U8TO64_LE( k + 8 );
+  u64 m;
+  const u8 *end = in + inlen - ( inlen % sizeof( u64 ) );
+  const int left = inlen & 7;
+  b = ( ( u64 )inlen ) << 56;
+  v3 ^= k1;
+  v2 ^= k0;
+  v1 ^= k1;
+  v0 ^= k0;
+
+  for ( ; in != end; in += 8 )
+  {
+    m = U8TO64_LE( in );
+    v3 ^= m;
+    SIPROUND;
+    SIPROUND;
+    v0 ^= m;
+  }
+
+  switch( left )
+  {
+  case 7: b |= ( ( u64 )in[ 6] )  << 48;
+  case 6: b |= ( ( u64 )in[ 5] )  << 40;
+  case 5: b |= ( ( u64 )in[ 4] )  << 32;
+  case 4: b |= ( ( u64 )in[ 3] )  << 24;
+  case 3: b |= ( ( u64 )in[ 2] )  << 16;
+  case 2: b |= ( ( u64 )in[ 1] )  <<  8;
+  case 1: b |= ( ( u64 )in[ 0] ); break;
+  case 0: break;
+  }
+
+  v3 ^= b;
+  SIPROUND;
+  SIPROUND;
+  v0 ^= b;
+  v2 ^= 0xff;
+  SIPROUND;
+  SIPROUND;
+  SIPROUND;
+  SIPROUND;
+  b = v0 ^ v1 ^ v2  ^ v3;
+  U64TO8_LE( out, b );
+  return 0;
+}
+

Example/Pods/libsodium-ios/src/libsodium/crypto_shorthash/siphash24/shorthash_siphash24_api.c

@@ -0,0 +1,11 @@
+#include "crypto_shorthash_siphash24.h"
+
+size_t
+crypto_shorthash_siphash24_bytes(void) {
+    return crypto_shorthash_siphash24_BYTES;
+}
+
+const char *
+crypto_shorthash_siphash24_primitive(void) {
+    return "siphash24";
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/crypto_sign.c

@@ -0,0 +1,61 @@
+
+#include "crypto_sign.h"
+
+size_t
+crypto_sign_bytes(void)
+{
+    return crypto_sign_BYTES;
+}
+
+size_t
+crypto_sign_seedbytes(void)
+{
+    return crypto_sign_SEEDBYTES;
+}
+
+size_t
+crypto_sign_publickeybytes(void)
+{
+    return crypto_sign_PUBLICKEYBYTES;
+}
+
+size_t
+crypto_sign_secretkeybytes(void)
+{
+    return crypto_sign_SECRETKEYBYTES;
+}
+
+const char *
+crypto_sign_primitive(void)
+{
+    return crypto_sign_PRIMITIVE;
+}
+
+int
+crypto_sign_seed_keypair(unsigned char *pk, unsigned char *sk,
+                         const unsigned char *seed)
+{
+    return crypto_sign_ed25519_seed_keypair(pk, sk, seed);
+}
+
+int
+crypto_sign_keypair(unsigned char *pk, unsigned char *sk)
+{
+    return crypto_sign_ed25519_keypair(pk, sk);
+}
+
+int
+crypto_sign(unsigned char *sm, unsigned long long *smlen,
+            const unsigned char *m, unsigned long long mlen,
+            const unsigned char *sk)
+{
+    return crypto_sign_ed25519(sm, smlen, m, mlen, sk);
+}
+
+int
+crypto_sign_open(unsigned char *m, unsigned long long *mlen,
+                 const unsigned char *sm, unsigned long long smlen,
+                 const unsigned char *pk)
+{
+    return crypto_sign_ed25519_open(m, mlen, sm, smlen, pk);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/api.h

@@ -0,0 +1,14 @@
+
+#include "crypto_sign_ed25519.h"
+
+#define crypto_sign crypto_sign_ed25519
+#define crypto_sign_open crypto_sign_ed25519_open
+#define crypto_sign_keypair crypto_sign_ed25519_keypair
+#define crypto_sign_seed_keypair crypto_sign_ed25519_seed_keypair
+#define crypto_sign_BYTES crypto_sign_ed25519_BYTES
+#define crypto_sign_SEEDBYTES crypto_sign_ed25519_SEEDBYTES
+#define crypto_sign_PUBLICKEYBYTES crypto_sign_ed25519_PUBLICKEYBYTES
+#define crypto_sign_SECRETKEYBYTES crypto_sign_ed25519_SECRETKEYBYTES
+#define crypto_sign_PRIMITIVE "ed25519"
+#define crypto_sign_IMPLEMENTATION crypto_sign_ed25519_IMPLEMENTATION
+#define crypto_sign_VERSION crypto_sign_ed25519_VERSION

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/base2.h

@@ -0,0 +1,40 @@
+ {
+  { 25967493,-14356035,29566456,3660896,-12694345,4014787,27544626,-11754271,-6079156,2047605 },
+  { -12545711,934262,-2722910,3049990,-727428,9406986,12720692,5043384,19500929,-15469378 },
+  { -8738181,4489570,9688441,-14785194,10184609,-12363380,29287919,11864899,-24514362,-4438546 },
+ },
+ {
+  { 15636291,-9688557,24204773,-7912398,616977,-16685262,27787600,-14772189,28944400,-1550024 },
+  { 16568933,4717097,-11556148,-1102322,15682896,-11807043,16354577,-11775962,7689662,11199574 },
+  { 30464156,-5976125,-11779434,-15670865,23220365,15915852,7512774,10017326,-17749093,-9920357 },
+ },
+ {
+  { 10861363,11473154,27284546,1981175,-30064349,12577861,32867885,14515107,-15438304,10819380 },
+  { 4708026,6336745,20377586,9066809,-11272109,6594696,-25653668,12483688,-12668491,5581306 },
+  { 19563160,16186464,-29386857,4097519,10237984,-4348115,28542350,13850243,-23678021,-15815942 },
+ },
+ {
+  { 5153746,9909285,1723747,-2777874,30523605,5516873,19480852,5230134,-23952439,-15175766 },
+  { -30269007,-3463509,7665486,10083793,28475525,1649722,20654025,16520125,30598449,7715701 },
+  { 28881845,14381568,9657904,3680757,-20181635,7843316,-31400660,1370708,29794553,-1409300 },
+ },
+ {
+  { -22518993,-6692182,14201702,-8745502,-23510406,8844726,18474211,-1361450,-13062696,13821877 },
+  { -6455177,-7839871,3374702,-4740862,-27098617,-10571707,31655028,-7212327,18853322,-14220951 },
+  { 4566830,-12963868,-28974889,-12240689,-7602672,-2830569,-8514358,-10431137,2207753,-3209784 },
+ },
+ {
+  { -25154831,-4185821,29681144,7868801,-6854661,-9423865,-12437364,-663000,-31111463,-16132436 },
+  { 25576264,-2703214,7349804,-11814844,16472782,9300885,3844789,15725684,171356,6466918 },
+  { 23103977,13316479,9739013,-16149481,817875,-15038942,8965339,-14088058,-30714912,16193877 },
+ },
+ {
+  { -33521811,3180713,-2394130,14003687,-16903474,-16270840,17238398,4729455,-18074513,9256800 },
+  { -25182317,-4174131,32336398,5036987,-21236817,11360617,22616405,9761698,-19827198,630305 },
+  { -13720693,2639453,-24237460,-7406481,9494427,-5774029,-6554551,-15960994,-2449256,-14291300 },
+ },
+ {
+  { -3151181,-5046075,9282714,6866145,-31907062,-863023,-18940575,15033784,25105118,-7894876 },
+  { -24326370,15950226,-31801215,-14592823,-11662737,-5090925,1573892,-2625887,2198790,-15804619 },
+  { -3099351,10324967,-2241613,7453183,-5446979,-2735503,-13812022,-16236442,-32461234,-12290683 },
+ },

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/d.h

@@ -0,0 +1 @@
+-10913610,13857413,-15372611,6949391,114729,-8787816,-6275908,-3247719,-18696448,-12055116

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/d2.h

@@ -0,0 +1 @@
+-21827239,-5839606,-30745221,13898782,229458,15978800,-12551817,-6495438,29715968,9444199

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe.h

@@ -0,0 +1,56 @@
+#ifndef FE_H
+#define FE_H
+
+#include "crypto_int32.h"
+
+typedef crypto_int32 fe[10];
+
+/*
+fe means field element.
+Here the field is \Z/(2^255-19).
+An element t, entries t[0]...t[9], represents the integer
+t[0]+2^26 t[1]+2^51 t[2]+2^77 t[3]+2^102 t[4]+...+2^230 t[9].
+Bounds on each t[i] vary depending on context.
+*/
+
+#define fe_frombytes crypto_sign_ed25519_ref10_fe_frombytes
+#define fe_tobytes crypto_sign_ed25519_ref10_fe_tobytes
+#define fe_copy crypto_sign_ed25519_ref10_fe_copy
+#define fe_isnonzero crypto_sign_ed25519_ref10_fe_isnonzero
+#define fe_isnegative crypto_sign_ed25519_ref10_fe_isnegative
+#define fe_0 crypto_sign_ed25519_ref10_fe_0
+#define fe_1 crypto_sign_ed25519_ref10_fe_1
+#define fe_cswap crypto_sign_ed25519_ref10_fe_cswap
+#define fe_cmov crypto_sign_ed25519_ref10_fe_cmov
+#define fe_add crypto_sign_ed25519_ref10_fe_add
+#define fe_sub crypto_sign_ed25519_ref10_fe_sub
+#define fe_neg crypto_sign_ed25519_ref10_fe_neg
+#define fe_mul crypto_sign_ed25519_ref10_fe_mul
+#define fe_sq crypto_sign_ed25519_ref10_fe_sq
+#define fe_sq2 crypto_sign_ed25519_ref10_fe_sq2
+#define fe_mul121666 crypto_sign_ed25519_ref10_fe_mul121666
+#define fe_invert crypto_sign_ed25519_ref10_fe_invert
+#define fe_pow22523 crypto_sign_ed25519_ref10_fe_pow22523
+
+extern void fe_frombytes(fe,const unsigned char *);
+extern void fe_tobytes(unsigned char *,const fe);
+
+extern void fe_copy(fe,const fe);
+extern int fe_isnonzero(const fe);
+extern int fe_isnegative(const fe);
+extern void fe_0(fe);
+extern void fe_1(fe);
+extern void fe_cswap(fe,fe,unsigned int);
+extern void fe_cmov(fe,const fe,unsigned int);
+
+extern void fe_add(fe,const fe,const fe);
+extern void fe_sub(fe,const fe,const fe);
+extern void fe_neg(fe,const fe);
+extern void fe_mul(fe,const fe,const fe);
+extern void fe_sq(fe,const fe);
+extern void fe_sq2(fe,const fe);
+extern void fe_mul121666(fe,const fe);
+extern void fe_invert(fe,const fe);
+extern void fe_pow22523(fe,const fe);
+
+#endif

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_0.c

@@ -0,0 +1,19 @@
+#include "fe.h"
+
+/*
+h = 0
+*/
+
+void fe_0(fe h)
+{
+  h[0] = 0;
+  h[1] = 0;
+  h[2] = 0;
+  h[3] = 0;
+  h[4] = 0;
+  h[5] = 0;
+  h[6] = 0;
+  h[7] = 0;
+  h[8] = 0;
+  h[9] = 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_1.c

@@ -0,0 +1,19 @@
+#include "fe.h"
+
+/*
+h = 1
+*/
+
+void fe_1(fe h)
+{
+  h[0] = 1;
+  h[1] = 0;
+  h[2] = 0;
+  h[3] = 0;
+  h[4] = 0;
+  h[5] = 0;
+  h[6] = 0;
+  h[7] = 0;
+  h[8] = 0;
+  h[9] = 0;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_add.c

@@ -0,0 +1,57 @@
+#include "fe.h"
+
+/*
+h = f + g
+Can overlap h with f or g.
+
+Preconditions:
+   |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+   |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+
+Postconditions:
+   |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
+*/
+
+void fe_add(fe h,const fe f,const fe g)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 g0 = g[0];
+  crypto_int32 g1 = g[1];
+  crypto_int32 g2 = g[2];
+  crypto_int32 g3 = g[3];
+  crypto_int32 g4 = g[4];
+  crypto_int32 g5 = g[5];
+  crypto_int32 g6 = g[6];
+  crypto_int32 g7 = g[7];
+  crypto_int32 g8 = g[8];
+  crypto_int32 g9 = g[9];
+  crypto_int32 h0 = f0 + g0;
+  crypto_int32 h1 = f1 + g1;
+  crypto_int32 h2 = f2 + g2;
+  crypto_int32 h3 = f3 + g3;
+  crypto_int32 h4 = f4 + g4;
+  crypto_int32 h5 = f5 + g5;
+  crypto_int32 h6 = f6 + g6;
+  crypto_int32 h7 = f7 + g7;
+  crypto_int32 h8 = f8 + g8;
+  crypto_int32 h9 = f9 + g9;
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_cmov.c

@@ -0,0 +1,63 @@
+#include "fe.h"
+
+/*
+Replace (f,g) with (g,g) if b == 1;
+replace (f,g) with (f,g) if b == 0.
+
+Preconditions: b in {0,1}.
+*/
+
+void fe_cmov(fe f,const fe g,unsigned int b)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 g0 = g[0];
+  crypto_int32 g1 = g[1];
+  crypto_int32 g2 = g[2];
+  crypto_int32 g3 = g[3];
+  crypto_int32 g4 = g[4];
+  crypto_int32 g5 = g[5];
+  crypto_int32 g6 = g[6];
+  crypto_int32 g7 = g[7];
+  crypto_int32 g8 = g[8];
+  crypto_int32 g9 = g[9];
+  crypto_int32 x0 = f0 ^ g0;
+  crypto_int32 x1 = f1 ^ g1;
+  crypto_int32 x2 = f2 ^ g2;
+  crypto_int32 x3 = f3 ^ g3;
+  crypto_int32 x4 = f4 ^ g4;
+  crypto_int32 x5 = f5 ^ g5;
+  crypto_int32 x6 = f6 ^ g6;
+  crypto_int32 x7 = f7 ^ g7;
+  crypto_int32 x8 = f8 ^ g8;
+  crypto_int32 x9 = f9 ^ g9;
+  b = -b;
+  x0 &= b;
+  x1 &= b;
+  x2 &= b;
+  x3 &= b;
+  x4 &= b;
+  x5 &= b;
+  x6 &= b;
+  x7 &= b;
+  x8 &= b;
+  x9 &= b;
+  f[0] = f0 ^ x0;
+  f[1] = f1 ^ x1;
+  f[2] = f2 ^ x2;
+  f[3] = f3 ^ x3;
+  f[4] = f4 ^ x4;
+  f[5] = f5 ^ x5;
+  f[6] = f6 ^ x6;
+  f[7] = f7 ^ x7;
+  f[8] = f8 ^ x8;
+  f[9] = f9 ^ x9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_copy.c

@@ -0,0 +1,29 @@
+#include "fe.h"
+
+/*
+h = f
+*/
+
+void fe_copy(fe h,const fe f)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  h[0] = f0;
+  h[1] = f1;
+  h[2] = f2;
+  h[3] = f3;
+  h[4] = f4;
+  h[5] = f5;
+  h[6] = f6;
+  h[7] = f7;
+  h[8] = f8;
+  h[9] = f9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_frombytes.c

@@ -0,0 +1,73 @@
+#include "fe.h"
+#include "crypto_int64.h"
+#include "crypto_uint64.h"
+
+static crypto_uint64 load_3(const unsigned char *in)
+{
+  crypto_uint64 result;
+  result = (crypto_uint64) in[0];
+  result |= ((crypto_uint64) in[1]) << 8;
+  result |= ((crypto_uint64) in[2]) << 16;
+  return result;
+}
+
+static crypto_uint64 load_4(const unsigned char *in)
+{
+  crypto_uint64 result;
+  result = (crypto_uint64) in[0];
+  result |= ((crypto_uint64) in[1]) << 8;
+  result |= ((crypto_uint64) in[2]) << 16;
+  result |= ((crypto_uint64) in[3]) << 24;
+  return result;
+}
+
+/*
+Ignores top bit of h.
+*/
+
+void fe_frombytes(fe h,const unsigned char *s)
+{
+  crypto_int64 h0 = load_4(s);
+  crypto_int64 h1 = load_3(s + 4) << 6;
+  crypto_int64 h2 = load_3(s + 7) << 5;
+  crypto_int64 h3 = load_3(s + 10) << 3;
+  crypto_int64 h4 = load_3(s + 13) << 2;
+  crypto_int64 h5 = load_4(s + 16);
+  crypto_int64 h6 = load_3(s + 20) << 7;
+  crypto_int64 h7 = load_3(s + 23) << 5;
+  crypto_int64 h8 = load_3(s + 26) << 4;
+  crypto_int64 h9 = (load_3(s + 29) & 8388607) << 2;
+  crypto_int64 carry0;
+  crypto_int64 carry1;
+  crypto_int64 carry2;
+  crypto_int64 carry3;
+  crypto_int64 carry4;
+  crypto_int64 carry5;
+  crypto_int64 carry6;
+  crypto_int64 carry7;
+  crypto_int64 carry8;
+  crypto_int64 carry9;
+
+  carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
+  carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
+  carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
+  carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
+  carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+  carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+  carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
+  carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
+
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_invert.c

@@ -0,0 +1,14 @@
+#include "fe.h"
+
+void fe_invert(fe out,const fe z)
+{
+  fe t0;
+  fe t1;
+  fe t2;
+  fe t3;
+  int i;
+
+#include "pow225521.h"
+
+  return;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_isnegative.c

@@ -0,0 +1,16 @@
+#include "fe.h"
+
+/*
+return 1 if f is in {1,3,5,...,q-2}
+return 0 if f is in {0,2,4,...,q-1}
+
+Preconditions:
+   |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
+*/
+
+int fe_isnegative(const fe f)
+{
+  unsigned char s[32];
+  fe_tobytes(s,f);
+  return s[0] & 1;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_isnonzero.c

@@ -0,0 +1,19 @@
+#include "fe.h"
+#include "crypto_verify_32.h"
+
+/*
+return 1 if f == 0
+return 0 if f != 0
+
+Preconditions:
+   |f| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
+*/
+
+static unsigned char zero[32];
+
+int fe_isnonzero(const fe f)
+{
+  unsigned char s[32];
+  fe_tobytes(s,f);
+  return crypto_verify_32(s,zero);
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_mul.c

@@ -0,0 +1,253 @@
+#include "fe.h"
+#include "crypto_int64.h"
+
+/*
+h = f * g
+Can overlap h with f or g.
+
+Preconditions:
+   |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
+   |g| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
+
+Postconditions:
+   |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
+*/
+
+/*
+Notes on implementation strategy:
+
+Using schoolbook multiplication.
+Karatsuba would save a little in some cost models.
+
+Most multiplications by 2 and 19 are 32-bit precomputations;
+cheaper than 64-bit postcomputations.
+
+There is one remaining multiplication by 19 in the carry chain;
+one *19 precomputation can be merged into this,
+but the resulting data flow is considerably less clean.
+
+There are 12 carries below.
+10 of them are 2-way parallelizable and vectorizable.
+Can get away with 11 carries, but then data flow is much deeper.
+
+With tighter constraints on inputs can squeeze carries into int32.
+*/
+
+void fe_mul(fe h,const fe f,const fe g)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 g0 = g[0];
+  crypto_int32 g1 = g[1];
+  crypto_int32 g2 = g[2];
+  crypto_int32 g3 = g[3];
+  crypto_int32 g4 = g[4];
+  crypto_int32 g5 = g[5];
+  crypto_int32 g6 = g[6];
+  crypto_int32 g7 = g[7];
+  crypto_int32 g8 = g[8];
+  crypto_int32 g9 = g[9];
+  crypto_int32 g1_19 = 19 * g1; /* 1.959375*2^29 */
+  crypto_int32 g2_19 = 19 * g2; /* 1.959375*2^30; still ok */
+  crypto_int32 g3_19 = 19 * g3;
+  crypto_int32 g4_19 = 19 * g4;
+  crypto_int32 g5_19 = 19 * g5;
+  crypto_int32 g6_19 = 19 * g6;
+  crypto_int32 g7_19 = 19 * g7;
+  crypto_int32 g8_19 = 19 * g8;
+  crypto_int32 g9_19 = 19 * g9;
+  crypto_int32 f1_2 = 2 * f1;
+  crypto_int32 f3_2 = 2 * f3;
+  crypto_int32 f5_2 = 2 * f5;
+  crypto_int32 f7_2 = 2 * f7;
+  crypto_int32 f9_2 = 2 * f9;
+  crypto_int64 f0g0    = f0   * (crypto_int64) g0;
+  crypto_int64 f0g1    = f0   * (crypto_int64) g1;
+  crypto_int64 f0g2    = f0   * (crypto_int64) g2;
+  crypto_int64 f0g3    = f0   * (crypto_int64) g3;
+  crypto_int64 f0g4    = f0   * (crypto_int64) g4;
+  crypto_int64 f0g5    = f0   * (crypto_int64) g5;
+  crypto_int64 f0g6    = f0   * (crypto_int64) g6;
+  crypto_int64 f0g7    = f0   * (crypto_int64) g7;
+  crypto_int64 f0g8    = f0   * (crypto_int64) g8;
+  crypto_int64 f0g9    = f0   * (crypto_int64) g9;
+  crypto_int64 f1g0    = f1   * (crypto_int64) g0;
+  crypto_int64 f1g1_2  = f1_2 * (crypto_int64) g1;
+  crypto_int64 f1g2    = f1   * (crypto_int64) g2;
+  crypto_int64 f1g3_2  = f1_2 * (crypto_int64) g3;
+  crypto_int64 f1g4    = f1   * (crypto_int64) g4;
+  crypto_int64 f1g5_2  = f1_2 * (crypto_int64) g5;
+  crypto_int64 f1g6    = f1   * (crypto_int64) g6;
+  crypto_int64 f1g7_2  = f1_2 * (crypto_int64) g7;
+  crypto_int64 f1g8    = f1   * (crypto_int64) g8;
+  crypto_int64 f1g9_38 = f1_2 * (crypto_int64) g9_19;
+  crypto_int64 f2g0    = f2   * (crypto_int64) g0;
+  crypto_int64 f2g1    = f2   * (crypto_int64) g1;
+  crypto_int64 f2g2    = f2   * (crypto_int64) g2;
+  crypto_int64 f2g3    = f2   * (crypto_int64) g3;
+  crypto_int64 f2g4    = f2   * (crypto_int64) g4;
+  crypto_int64 f2g5    = f2   * (crypto_int64) g5;
+  crypto_int64 f2g6    = f2   * (crypto_int64) g6;
+  crypto_int64 f2g7    = f2   * (crypto_int64) g7;
+  crypto_int64 f2g8_19 = f2   * (crypto_int64) g8_19;
+  crypto_int64 f2g9_19 = f2   * (crypto_int64) g9_19;
+  crypto_int64 f3g0    = f3   * (crypto_int64) g0;
+  crypto_int64 f3g1_2  = f3_2 * (crypto_int64) g1;
+  crypto_int64 f3g2    = f3   * (crypto_int64) g2;
+  crypto_int64 f3g3_2  = f3_2 * (crypto_int64) g3;
+  crypto_int64 f3g4    = f3   * (crypto_int64) g4;
+  crypto_int64 f3g5_2  = f3_2 * (crypto_int64) g5;
+  crypto_int64 f3g6    = f3   * (crypto_int64) g6;
+  crypto_int64 f3g7_38 = f3_2 * (crypto_int64) g7_19;
+  crypto_int64 f3g8_19 = f3   * (crypto_int64) g8_19;
+  crypto_int64 f3g9_38 = f3_2 * (crypto_int64) g9_19;
+  crypto_int64 f4g0    = f4   * (crypto_int64) g0;
+  crypto_int64 f4g1    = f4   * (crypto_int64) g1;
+  crypto_int64 f4g2    = f4   * (crypto_int64) g2;
+  crypto_int64 f4g3    = f4   * (crypto_int64) g3;
+  crypto_int64 f4g4    = f4   * (crypto_int64) g4;
+  crypto_int64 f4g5    = f4   * (crypto_int64) g5;
+  crypto_int64 f4g6_19 = f4   * (crypto_int64) g6_19;
+  crypto_int64 f4g7_19 = f4   * (crypto_int64) g7_19;
+  crypto_int64 f4g8_19 = f4   * (crypto_int64) g8_19;
+  crypto_int64 f4g9_19 = f4   * (crypto_int64) g9_19;
+  crypto_int64 f5g0    = f5   * (crypto_int64) g0;
+  crypto_int64 f5g1_2  = f5_2 * (crypto_int64) g1;
+  crypto_int64 f5g2    = f5   * (crypto_int64) g2;
+  crypto_int64 f5g3_2  = f5_2 * (crypto_int64) g3;
+  crypto_int64 f5g4    = f5   * (crypto_int64) g4;
+  crypto_int64 f5g5_38 = f5_2 * (crypto_int64) g5_19;
+  crypto_int64 f5g6_19 = f5   * (crypto_int64) g6_19;
+  crypto_int64 f5g7_38 = f5_2 * (crypto_int64) g7_19;
+  crypto_int64 f5g8_19 = f5   * (crypto_int64) g8_19;
+  crypto_int64 f5g9_38 = f5_2 * (crypto_int64) g9_19;
+  crypto_int64 f6g0    = f6   * (crypto_int64) g0;
+  crypto_int64 f6g1    = f6   * (crypto_int64) g1;
+  crypto_int64 f6g2    = f6   * (crypto_int64) g2;
+  crypto_int64 f6g3    = f6   * (crypto_int64) g3;
+  crypto_int64 f6g4_19 = f6   * (crypto_int64) g4_19;
+  crypto_int64 f6g5_19 = f6   * (crypto_int64) g5_19;
+  crypto_int64 f6g6_19 = f6   * (crypto_int64) g6_19;
+  crypto_int64 f6g7_19 = f6   * (crypto_int64) g7_19;
+  crypto_int64 f6g8_19 = f6   * (crypto_int64) g8_19;
+  crypto_int64 f6g9_19 = f6   * (crypto_int64) g9_19;
+  crypto_int64 f7g0    = f7   * (crypto_int64) g0;
+  crypto_int64 f7g1_2  = f7_2 * (crypto_int64) g1;
+  crypto_int64 f7g2    = f7   * (crypto_int64) g2;
+  crypto_int64 f7g3_38 = f7_2 * (crypto_int64) g3_19;
+  crypto_int64 f7g4_19 = f7   * (crypto_int64) g4_19;
+  crypto_int64 f7g5_38 = f7_2 * (crypto_int64) g5_19;
+  crypto_int64 f7g6_19 = f7   * (crypto_int64) g6_19;
+  crypto_int64 f7g7_38 = f7_2 * (crypto_int64) g7_19;
+  crypto_int64 f7g8_19 = f7   * (crypto_int64) g8_19;
+  crypto_int64 f7g9_38 = f7_2 * (crypto_int64) g9_19;
+  crypto_int64 f8g0    = f8   * (crypto_int64) g0;
+  crypto_int64 f8g1    = f8   * (crypto_int64) g1;
+  crypto_int64 f8g2_19 = f8   * (crypto_int64) g2_19;
+  crypto_int64 f8g3_19 = f8   * (crypto_int64) g3_19;
+  crypto_int64 f8g4_19 = f8   * (crypto_int64) g4_19;
+  crypto_int64 f8g5_19 = f8   * (crypto_int64) g5_19;
+  crypto_int64 f8g6_19 = f8   * (crypto_int64) g6_19;
+  crypto_int64 f8g7_19 = f8   * (crypto_int64) g7_19;
+  crypto_int64 f8g8_19 = f8   * (crypto_int64) g8_19;
+  crypto_int64 f8g9_19 = f8   * (crypto_int64) g9_19;
+  crypto_int64 f9g0    = f9   * (crypto_int64) g0;
+  crypto_int64 f9g1_38 = f9_2 * (crypto_int64) g1_19;
+  crypto_int64 f9g2_19 = f9   * (crypto_int64) g2_19;
+  crypto_int64 f9g3_38 = f9_2 * (crypto_int64) g3_19;
+  crypto_int64 f9g4_19 = f9   * (crypto_int64) g4_19;
+  crypto_int64 f9g5_38 = f9_2 * (crypto_int64) g5_19;
+  crypto_int64 f9g6_19 = f9   * (crypto_int64) g6_19;
+  crypto_int64 f9g7_38 = f9_2 * (crypto_int64) g7_19;
+  crypto_int64 f9g8_19 = f9   * (crypto_int64) g8_19;
+  crypto_int64 f9g9_38 = f9_2 * (crypto_int64) g9_19;
+  crypto_int64 h0 = f0g0+f1g9_38+f2g8_19+f3g7_38+f4g6_19+f5g5_38+f6g4_19+f7g3_38+f8g2_19+f9g1_38;
+  crypto_int64 h1 = f0g1+f1g0   +f2g9_19+f3g8_19+f4g7_19+f5g6_19+f6g5_19+f7g4_19+f8g3_19+f9g2_19;
+  crypto_int64 h2 = f0g2+f1g1_2 +f2g0   +f3g9_38+f4g8_19+f5g7_38+f6g6_19+f7g5_38+f8g4_19+f9g3_38;
+  crypto_int64 h3 = f0g3+f1g2   +f2g1   +f3g0   +f4g9_19+f5g8_19+f6g7_19+f7g6_19+f8g5_19+f9g4_19;
+  crypto_int64 h4 = f0g4+f1g3_2 +f2g2   +f3g1_2 +f4g0   +f5g9_38+f6g8_19+f7g7_38+f8g6_19+f9g5_38;
+  crypto_int64 h5 = f0g5+f1g4   +f2g3   +f3g2   +f4g1   +f5g0   +f6g9_19+f7g8_19+f8g7_19+f9g6_19;
+  crypto_int64 h6 = f0g6+f1g5_2 +f2g4   +f3g3_2 +f4g2   +f5g1_2 +f6g0   +f7g9_38+f8g8_19+f9g7_38;
+  crypto_int64 h7 = f0g7+f1g6   +f2g5   +f3g4   +f4g3   +f5g2   +f6g1   +f7g0   +f8g9_19+f9g8_19;
+  crypto_int64 h8 = f0g8+f1g7_2 +f2g6   +f3g5_2 +f4g4   +f5g3_2 +f6g2   +f7g1_2 +f8g0   +f9g9_38;
+  crypto_int64 h9 = f0g9+f1g8   +f2g7   +f3g6   +f4g5   +f5g4   +f6g3   +f7g2   +f8g1   +f9g0   ;
+  crypto_int64 carry0;
+  crypto_int64 carry1;
+  crypto_int64 carry2;
+  crypto_int64 carry3;
+  crypto_int64 carry4;
+  crypto_int64 carry5;
+  crypto_int64 carry6;
+  crypto_int64 carry7;
+  crypto_int64 carry8;
+  crypto_int64 carry9;
+
+  /*
+  |h0| <= (1.65*1.65*2^52*(1+19+19+19+19)+1.65*1.65*2^50*(38+38+38+38+38))
+    i.e. |h0| <= 1.4*2^60; narrower ranges for h2, h4, h6, h8
+  |h1| <= (1.65*1.65*2^51*(1+1+19+19+19+19+19+19+19+19))
+    i.e. |h1| <= 1.7*2^59; narrower ranges for h3, h5, h7, h9
+  */
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+  /* |h0| <= 2^25 */
+  /* |h4| <= 2^25 */
+  /* |h1| <= 1.71*2^59 */
+  /* |h5| <= 1.71*2^59 */
+
+  carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
+  carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
+  /* |h1| <= 2^24; from now on fits into int32 */
+  /* |h5| <= 2^24; from now on fits into int32 */
+  /* |h2| <= 1.41*2^60 */
+  /* |h6| <= 1.41*2^60 */
+
+  carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
+  carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
+  /* |h2| <= 2^25; from now on fits into int32 unchanged */
+  /* |h6| <= 2^25; from now on fits into int32 unchanged */
+  /* |h3| <= 1.71*2^59 */
+  /* |h7| <= 1.71*2^59 */
+
+  carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
+  carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
+  /* |h3| <= 2^24; from now on fits into int32 unchanged */
+  /* |h7| <= 2^24; from now on fits into int32 unchanged */
+  /* |h4| <= 1.72*2^34 */
+  /* |h8| <= 1.41*2^60 */
+
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+  carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
+  /* |h4| <= 2^25; from now on fits into int32 unchanged */
+  /* |h8| <= 2^25; from now on fits into int32 unchanged */
+  /* |h5| <= 1.01*2^24 */
+  /* |h9| <= 1.71*2^59 */
+
+  carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
+  /* |h9| <= 2^24; from now on fits into int32 unchanged */
+  /* |h0| <= 1.1*2^39 */
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+  /* |h0| <= 2^25; from now on fits into int32 unchanged */
+  /* |h1| <= 1.01*2^24 */
+
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_neg.c

@@ -0,0 +1,45 @@
+#include "fe.h"
+
+/*
+h = -f
+
+Preconditions:
+   |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+
+Postconditions:
+   |h| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+*/
+
+void fe_neg(fe h,const fe f)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 h0 = -f0;
+  crypto_int32 h1 = -f1;
+  crypto_int32 h2 = -f2;
+  crypto_int32 h3 = -f3;
+  crypto_int32 h4 = -f4;
+  crypto_int32 h5 = -f5;
+  crypto_int32 h6 = -f6;
+  crypto_int32 h7 = -f7;
+  crypto_int32 h8 = -f8;
+  crypto_int32 h9 = -f9;
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_pow22523.c

@@ -0,0 +1,13 @@
+#include "fe.h"
+
+void fe_pow22523(fe out,const fe z)
+{
+  fe t0;
+  fe t1;
+  fe t2;
+  int i;
+
+#include "pow22523.h"
+
+  return;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_sq.c

@@ -0,0 +1,149 @@
+#include "fe.h"
+#include "crypto_int64.h"
+
+/*
+h = f * f
+Can overlap h with f.
+
+Preconditions:
+   |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
+
+Postconditions:
+   |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
+*/
+
+/*
+See fe_mul.c for discussion of implementation strategy.
+*/
+
+void fe_sq(fe h,const fe f)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 f0_2 = 2 * f0;
+  crypto_int32 f1_2 = 2 * f1;
+  crypto_int32 f2_2 = 2 * f2;
+  crypto_int32 f3_2 = 2 * f3;
+  crypto_int32 f4_2 = 2 * f4;
+  crypto_int32 f5_2 = 2 * f5;
+  crypto_int32 f6_2 = 2 * f6;
+  crypto_int32 f7_2 = 2 * f7;
+  crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
+  crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
+  crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
+  crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
+  crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
+  crypto_int64 f0f0    = f0   * (crypto_int64) f0;
+  crypto_int64 f0f1_2  = f0_2 * (crypto_int64) f1;
+  crypto_int64 f0f2_2  = f0_2 * (crypto_int64) f2;
+  crypto_int64 f0f3_2  = f0_2 * (crypto_int64) f3;
+  crypto_int64 f0f4_2  = f0_2 * (crypto_int64) f4;
+  crypto_int64 f0f5_2  = f0_2 * (crypto_int64) f5;
+  crypto_int64 f0f6_2  = f0_2 * (crypto_int64) f6;
+  crypto_int64 f0f7_2  = f0_2 * (crypto_int64) f7;
+  crypto_int64 f0f8_2  = f0_2 * (crypto_int64) f8;
+  crypto_int64 f0f9_2  = f0_2 * (crypto_int64) f9;
+  crypto_int64 f1f1_2  = f1_2 * (crypto_int64) f1;
+  crypto_int64 f1f2_2  = f1_2 * (crypto_int64) f2;
+  crypto_int64 f1f3_4  = f1_2 * (crypto_int64) f3_2;
+  crypto_int64 f1f4_2  = f1_2 * (crypto_int64) f4;
+  crypto_int64 f1f5_4  = f1_2 * (crypto_int64) f5_2;
+  crypto_int64 f1f6_2  = f1_2 * (crypto_int64) f6;
+  crypto_int64 f1f7_4  = f1_2 * (crypto_int64) f7_2;
+  crypto_int64 f1f8_2  = f1_2 * (crypto_int64) f8;
+  crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
+  crypto_int64 f2f2    = f2   * (crypto_int64) f2;
+  crypto_int64 f2f3_2  = f2_2 * (crypto_int64) f3;
+  crypto_int64 f2f4_2  = f2_2 * (crypto_int64) f4;
+  crypto_int64 f2f5_2  = f2_2 * (crypto_int64) f5;
+  crypto_int64 f2f6_2  = f2_2 * (crypto_int64) f6;
+  crypto_int64 f2f7_2  = f2_2 * (crypto_int64) f7;
+  crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
+  crypto_int64 f2f9_38 = f2   * (crypto_int64) f9_38;
+  crypto_int64 f3f3_2  = f3_2 * (crypto_int64) f3;
+  crypto_int64 f3f4_2  = f3_2 * (crypto_int64) f4;
+  crypto_int64 f3f5_4  = f3_2 * (crypto_int64) f5_2;
+  crypto_int64 f3f6_2  = f3_2 * (crypto_int64) f6;
+  crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
+  crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
+  crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
+  crypto_int64 f4f4    = f4   * (crypto_int64) f4;
+  crypto_int64 f4f5_2  = f4_2 * (crypto_int64) f5;
+  crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
+  crypto_int64 f4f7_38 = f4   * (crypto_int64) f7_38;
+  crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
+  crypto_int64 f4f9_38 = f4   * (crypto_int64) f9_38;
+  crypto_int64 f5f5_38 = f5   * (crypto_int64) f5_38;
+  crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
+  crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
+  crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
+  crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
+  crypto_int64 f6f6_19 = f6   * (crypto_int64) f6_19;
+  crypto_int64 f6f7_38 = f6   * (crypto_int64) f7_38;
+  crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
+  crypto_int64 f6f9_38 = f6   * (crypto_int64) f9_38;
+  crypto_int64 f7f7_38 = f7   * (crypto_int64) f7_38;
+  crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
+  crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
+  crypto_int64 f8f8_19 = f8   * (crypto_int64) f8_19;
+  crypto_int64 f8f9_38 = f8   * (crypto_int64) f9_38;
+  crypto_int64 f9f9_38 = f9   * (crypto_int64) f9_38;
+  crypto_int64 h0 = f0f0  +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
+  crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
+  crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
+  crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
+  crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2   +f5f9_76+f6f8_38+f7f7_38;
+  crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
+  crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
+  crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
+  crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4   +f9f9_38;
+  crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
+  crypto_int64 carry0;
+  crypto_int64 carry1;
+  crypto_int64 carry2;
+  crypto_int64 carry3;
+  crypto_int64 carry4;
+  crypto_int64 carry5;
+  crypto_int64 carry6;
+  crypto_int64 carry7;
+  crypto_int64 carry8;
+  crypto_int64 carry9;
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+
+  carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
+  carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
+
+  carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
+  carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
+
+  carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
+  carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
+
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+  carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
+
+  carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_sq2.c

@@ -0,0 +1,160 @@
+#include "fe.h"
+#include "crypto_int64.h"
+
+/*
+h = 2 * f * f
+Can overlap h with f.
+
+Preconditions:
+   |f| bounded by 1.65*2^26,1.65*2^25,1.65*2^26,1.65*2^25,etc.
+
+Postconditions:
+   |h| bounded by 1.01*2^25,1.01*2^24,1.01*2^25,1.01*2^24,etc.
+*/
+
+/*
+See fe_mul.c for discussion of implementation strategy.
+*/
+
+void fe_sq2(fe h,const fe f)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 f0_2 = 2 * f0;
+  crypto_int32 f1_2 = 2 * f1;
+  crypto_int32 f2_2 = 2 * f2;
+  crypto_int32 f3_2 = 2 * f3;
+  crypto_int32 f4_2 = 2 * f4;
+  crypto_int32 f5_2 = 2 * f5;
+  crypto_int32 f6_2 = 2 * f6;
+  crypto_int32 f7_2 = 2 * f7;
+  crypto_int32 f5_38 = 38 * f5; /* 1.959375*2^30 */
+  crypto_int32 f6_19 = 19 * f6; /* 1.959375*2^30 */
+  crypto_int32 f7_38 = 38 * f7; /* 1.959375*2^30 */
+  crypto_int32 f8_19 = 19 * f8; /* 1.959375*2^30 */
+  crypto_int32 f9_38 = 38 * f9; /* 1.959375*2^30 */
+  crypto_int64 f0f0    = f0   * (crypto_int64) f0;
+  crypto_int64 f0f1_2  = f0_2 * (crypto_int64) f1;
+  crypto_int64 f0f2_2  = f0_2 * (crypto_int64) f2;
+  crypto_int64 f0f3_2  = f0_2 * (crypto_int64) f3;
+  crypto_int64 f0f4_2  = f0_2 * (crypto_int64) f4;
+  crypto_int64 f0f5_2  = f0_2 * (crypto_int64) f5;
+  crypto_int64 f0f6_2  = f0_2 * (crypto_int64) f6;
+  crypto_int64 f0f7_2  = f0_2 * (crypto_int64) f7;
+  crypto_int64 f0f8_2  = f0_2 * (crypto_int64) f8;
+  crypto_int64 f0f9_2  = f0_2 * (crypto_int64) f9;
+  crypto_int64 f1f1_2  = f1_2 * (crypto_int64) f1;
+  crypto_int64 f1f2_2  = f1_2 * (crypto_int64) f2;
+  crypto_int64 f1f3_4  = f1_2 * (crypto_int64) f3_2;
+  crypto_int64 f1f4_2  = f1_2 * (crypto_int64) f4;
+  crypto_int64 f1f5_4  = f1_2 * (crypto_int64) f5_2;
+  crypto_int64 f1f6_2  = f1_2 * (crypto_int64) f6;
+  crypto_int64 f1f7_4  = f1_2 * (crypto_int64) f7_2;
+  crypto_int64 f1f8_2  = f1_2 * (crypto_int64) f8;
+  crypto_int64 f1f9_76 = f1_2 * (crypto_int64) f9_38;
+  crypto_int64 f2f2    = f2   * (crypto_int64) f2;
+  crypto_int64 f2f3_2  = f2_2 * (crypto_int64) f3;
+  crypto_int64 f2f4_2  = f2_2 * (crypto_int64) f4;
+  crypto_int64 f2f5_2  = f2_2 * (crypto_int64) f5;
+  crypto_int64 f2f6_2  = f2_2 * (crypto_int64) f6;
+  crypto_int64 f2f7_2  = f2_2 * (crypto_int64) f7;
+  crypto_int64 f2f8_38 = f2_2 * (crypto_int64) f8_19;
+  crypto_int64 f2f9_38 = f2   * (crypto_int64) f9_38;
+  crypto_int64 f3f3_2  = f3_2 * (crypto_int64) f3;
+  crypto_int64 f3f4_2  = f3_2 * (crypto_int64) f4;
+  crypto_int64 f3f5_4  = f3_2 * (crypto_int64) f5_2;
+  crypto_int64 f3f6_2  = f3_2 * (crypto_int64) f6;
+  crypto_int64 f3f7_76 = f3_2 * (crypto_int64) f7_38;
+  crypto_int64 f3f8_38 = f3_2 * (crypto_int64) f8_19;
+  crypto_int64 f3f9_76 = f3_2 * (crypto_int64) f9_38;
+  crypto_int64 f4f4    = f4   * (crypto_int64) f4;
+  crypto_int64 f4f5_2  = f4_2 * (crypto_int64) f5;
+  crypto_int64 f4f6_38 = f4_2 * (crypto_int64) f6_19;
+  crypto_int64 f4f7_38 = f4   * (crypto_int64) f7_38;
+  crypto_int64 f4f8_38 = f4_2 * (crypto_int64) f8_19;
+  crypto_int64 f4f9_38 = f4   * (crypto_int64) f9_38;
+  crypto_int64 f5f5_38 = f5   * (crypto_int64) f5_38;
+  crypto_int64 f5f6_38 = f5_2 * (crypto_int64) f6_19;
+  crypto_int64 f5f7_76 = f5_2 * (crypto_int64) f7_38;
+  crypto_int64 f5f8_38 = f5_2 * (crypto_int64) f8_19;
+  crypto_int64 f5f9_76 = f5_2 * (crypto_int64) f9_38;
+  crypto_int64 f6f6_19 = f6   * (crypto_int64) f6_19;
+  crypto_int64 f6f7_38 = f6   * (crypto_int64) f7_38;
+  crypto_int64 f6f8_38 = f6_2 * (crypto_int64) f8_19;
+  crypto_int64 f6f9_38 = f6   * (crypto_int64) f9_38;
+  crypto_int64 f7f7_38 = f7   * (crypto_int64) f7_38;
+  crypto_int64 f7f8_38 = f7_2 * (crypto_int64) f8_19;
+  crypto_int64 f7f9_76 = f7_2 * (crypto_int64) f9_38;
+  crypto_int64 f8f8_19 = f8   * (crypto_int64) f8_19;
+  crypto_int64 f8f9_38 = f8   * (crypto_int64) f9_38;
+  crypto_int64 f9f9_38 = f9   * (crypto_int64) f9_38;
+  crypto_int64 h0 = f0f0  +f1f9_76+f2f8_38+f3f7_76+f4f6_38+f5f5_38;
+  crypto_int64 h1 = f0f1_2+f2f9_38+f3f8_38+f4f7_38+f5f6_38;
+  crypto_int64 h2 = f0f2_2+f1f1_2 +f3f9_76+f4f8_38+f5f7_76+f6f6_19;
+  crypto_int64 h3 = f0f3_2+f1f2_2 +f4f9_38+f5f8_38+f6f7_38;
+  crypto_int64 h4 = f0f4_2+f1f3_4 +f2f2   +f5f9_76+f6f8_38+f7f7_38;
+  crypto_int64 h5 = f0f5_2+f1f4_2 +f2f3_2 +f6f9_38+f7f8_38;
+  crypto_int64 h6 = f0f6_2+f1f5_4 +f2f4_2 +f3f3_2 +f7f9_76+f8f8_19;
+  crypto_int64 h7 = f0f7_2+f1f6_2 +f2f5_2 +f3f4_2 +f8f9_38;
+  crypto_int64 h8 = f0f8_2+f1f7_4 +f2f6_2 +f3f5_4 +f4f4   +f9f9_38;
+  crypto_int64 h9 = f0f9_2+f1f8_2 +f2f7_2 +f3f6_2 +f4f5_2;
+  crypto_int64 carry0;
+  crypto_int64 carry1;
+  crypto_int64 carry2;
+  crypto_int64 carry3;
+  crypto_int64 carry4;
+  crypto_int64 carry5;
+  crypto_int64 carry6;
+  crypto_int64 carry7;
+  crypto_int64 carry8;
+  crypto_int64 carry9;
+
+  h0 += h0;
+  h1 += h1;
+  h2 += h2;
+  h3 += h3;
+  h4 += h4;
+  h5 += h5;
+  h6 += h6;
+  h7 += h7;
+  h8 += h8;
+  h9 += h9;
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+
+  carry1 = (h1 + (crypto_int64) (1<<24)) >> 25; h2 += carry1; h1 -= carry1 << 25;
+  carry5 = (h5 + (crypto_int64) (1<<24)) >> 25; h6 += carry5; h5 -= carry5 << 25;
+
+  carry2 = (h2 + (crypto_int64) (1<<25)) >> 26; h3 += carry2; h2 -= carry2 << 26;
+  carry6 = (h6 + (crypto_int64) (1<<25)) >> 26; h7 += carry6; h6 -= carry6 << 26;
+
+  carry3 = (h3 + (crypto_int64) (1<<24)) >> 25; h4 += carry3; h3 -= carry3 << 25;
+  carry7 = (h7 + (crypto_int64) (1<<24)) >> 25; h8 += carry7; h7 -= carry7 << 25;
+
+  carry4 = (h4 + (crypto_int64) (1<<25)) >> 26; h5 += carry4; h4 -= carry4 << 26;
+  carry8 = (h8 + (crypto_int64) (1<<25)) >> 26; h9 += carry8; h8 -= carry8 << 26;
+
+  carry9 = (h9 + (crypto_int64) (1<<24)) >> 25; h0 += carry9 * 19; h9 -= carry9 << 25;
+
+  carry0 = (h0 + (crypto_int64) (1<<25)) >> 26; h1 += carry0; h0 -= carry0 << 26;
+
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_sub.c

@@ -0,0 +1,57 @@
+#include "fe.h"
+
+/*
+h = f - g
+Can overlap h with f or g.
+
+Preconditions:
+   |f| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+   |g| bounded by 1.1*2^25,1.1*2^24,1.1*2^25,1.1*2^24,etc.
+
+Postconditions:
+   |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
+*/
+
+void fe_sub(fe h,const fe f,const fe g)
+{
+  crypto_int32 f0 = f[0];
+  crypto_int32 f1 = f[1];
+  crypto_int32 f2 = f[2];
+  crypto_int32 f3 = f[3];
+  crypto_int32 f4 = f[4];
+  crypto_int32 f5 = f[5];
+  crypto_int32 f6 = f[6];
+  crypto_int32 f7 = f[7];
+  crypto_int32 f8 = f[8];
+  crypto_int32 f9 = f[9];
+  crypto_int32 g0 = g[0];
+  crypto_int32 g1 = g[1];
+  crypto_int32 g2 = g[2];
+  crypto_int32 g3 = g[3];
+  crypto_int32 g4 = g[4];
+  crypto_int32 g5 = g[5];
+  crypto_int32 g6 = g[6];
+  crypto_int32 g7 = g[7];
+  crypto_int32 g8 = g[8];
+  crypto_int32 g9 = g[9];
+  crypto_int32 h0 = f0 - g0;
+  crypto_int32 h1 = f1 - g1;
+  crypto_int32 h2 = f2 - g2;
+  crypto_int32 h3 = f3 - g3;
+  crypto_int32 h4 = f4 - g4;
+  crypto_int32 h5 = f5 - g5;
+  crypto_int32 h6 = f6 - g6;
+  crypto_int32 h7 = f7 - g7;
+  crypto_int32 h8 = f8 - g8;
+  crypto_int32 h9 = f9 - g9;
+  h[0] = h0;
+  h[1] = h1;
+  h[2] = h2;
+  h[3] = h3;
+  h[4] = h4;
+  h[5] = h5;
+  h[6] = h6;
+  h[7] = h7;
+  h[8] = h8;
+  h[9] = h9;
+}

Example/Pods/libsodium-ios/src/libsodium/crypto_sign/ed25519/ref10/fe_tobytes.c

@@ -0,0 +1,119 @@
+#include "fe.h"
+
+/*
+Preconditions:
+  |h| bounded by 1.1*2^26,1.1*2^25,1.1*2^26,1.1*2^25,etc.
+
+Write p=2^255-19; q=floor(h/p).
+Basic claim: q = floor(2^(-255)(h + 19 2^(-25)h9 + 2^(-1))).
+
+Proof:
+  Have |h|<=p so |q|<=1 so |19^2 2^(-255) q|<1/4.
+  Also have |h-2^230 h9|<2^231 so |19 2^(-255)(h-2^230 h9)|<1/4.
+
+  Write y=2^(-1)-19^2 2^(-255)q-19 2^(-255)(h-2^230 h9).
+  Then 0<y<1.
+
+  Write r=h-pq.
+  Have 0<=r<=p-1=2^255-20.
+  Thus 0<=r+19(2^-255)r<r+19(2^-255)2^255<=2^255-1.
+
+  Write x=r+19(2^-255)r+y.
+  Then 0<x<2^255 so floor(2^(-255)x) = 0 so floor(q+2^(-255)x) = q.
+
+  Have q+2^(-255)x = 2^(-255)(h + 19 2^(-25) h9 + 2^(-1))
+  so floor(2^(-255)(h + 19 2^(-25) h9 + 2^(-1))) = q.
+*/
+
+void fe_tobytes(unsigned char *s,const fe h)
+{
+  crypto_int32 h0 = h[0];
+  crypto_int32 h1 = h[1];
+  crypto_int32 h2 = h[2];
+  crypto_int32 h3 = h[3];
+  crypto_int32 h4 = h[4];
+  crypto_int32 h5 = h[5];
+  crypto_int32 h6 = h[6];
+  crypto_int32 h7 = h[7];
+  crypto_int32 h8 = h[8];
+  crypto_int32 h9 = h[9];
+  crypto_int32 q;
+  crypto_int32 carry0;
+  crypto_int32 carry1;
+  crypto_int32 carry2;
+  crypto_int32 carry3;
+  crypto_int32 carry4;
+  crypto_int32 carry5;
+  crypto_int32 carry6;
+  crypto_int32 carry7;
+  crypto_int32 carry8;
+  crypto_int32 carry9;
+
+  q = (19 * h9 + (((crypto_int32) 1) << 24)) >> 25;
+  q = (h0 + q) >> 26;
+  q = (h1 + q) >> 25;
+  q = (h2 + q) >> 26;
+  q = (h3 + q) >> 25;
+  q = (h4 + q) >> 26;
+  q = (h5 + q) >> 25;
+  q = (h6 + q) >> 26;
+  q = (h7 + q) >> 25;
+  q = (h8 + q) >> 26;
+  q = (h9 + q) >> 25;
+
+  /* Goal: Output h-(2^255-19)q, which is between 0 and 2^255-20. */
+  h0 += 19 * q;
+  /* Goal: Output h-2^255 q, which is between 0 and 2^255-20. */
+
+  carry0 = h0 >> 26; h1 += carry0; h0 -= carry0 << 26;
+  carry1 = h1 >> 25; h2 += carry1; h1 -= carry1 << 25;
+  carry2 = h2 >> 26; h3 += carry2; h2 -= carry2 << 26;
+  carry3 = h3 >> 25; h4 += carry3; h3 -= carry3 << 25;
+  carry4 = h4 >> 26; h5 += carry4; h4 -= carry4 << 26;
+  carry5 = h5 >> 25; h6 += carry5; h5 -= carry5 << 25;
+  carry6 = h6 >> 26; h7 += carry6; h6 -= carry6 << 26;
+  carry7 = h7 >> 25; h8 += carry7; h7 -= carry7 << 25;
+  carry8 = h8 >> 26; h9 += carry8; h8 -= carry8 << 26;
+  carry9 = h9 >> 25;               h9 -= carry9 << 25;
+                  /* h10 = carry9 */
+
+  /*
+  Goal: Output h0+...+2^255 h10-2^255 q, which is between 0 and 2^255-20.
+  Have h0+...+2^230 h9 between 0 and 2^255-1;
+  evidently 2^255 h10-2^255 q = 0.
+  Goal: Output h0+...+2^230 h9.
+  */
+
+  s[0] = h0 >> 0;
+  s[1] = h0 >> 8;
+  s[2] = h0 >> 16;
+  s[3] = (h0 >> 24) | (h1 << 2);
+  s[4] = h1 >> 6;
+  s[5] = h1 >> 14;
+  s[6] = (h1 >> 22) | (h2 << 3);
+  s[7] = h2 >> 5;
+  s[8] = h2 >> 13;
+  s[9] = (h2 >> 21) | (h3 << 5);
+  s[10] = h3 >> 3;
+  s[11] = h3 >> 11;
+  s[12] = (h3 >> 19) | (h4 << 6);
+  s[13] = h4 >> 2;
+  s[14] = h4 >> 10;
+  s[15] = h4 >> 18;
+  s[16] = h5 >> 0;
+  s[17] = h5 >> 8;
+  s[18] = h5 >> 16;
+  s[19] = (h5 >> 24) | (h6 << 1);
+  s[20] = h6 >> 7;
+  s[21] = h6 >> 15;
+  s[22] = (h6 >> 23) | (h7 << 3);
+  s[23] = h7 >> 5;
+  s[24] = h7 >> 13;
+  s[25] = (h7 >> 21) | (h8 << 4);
+  s[26] = h8 >> 4;
+  s[27] = h8 >> 12;
+  s[28] = (h8 >> 20) | (h9 << 6);
+  s[29] = h9 >> 2;
+  s[30] = h9 >> 10;
+  s[31] = h9 >> 18;
+}